chore(deps): update github-actions (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
EndBug/add-and-commit	action	major	v10.0.0 → v11.1.1
actions/checkout	action	major	v6.0.2 → v7.0.1
astral-sh/setup-uv	action	major	v9.0.0 → v10.0.1

---

Release Notes

EndBug/add-and-commit (EndBug/add-and-commit)

v11.1.1

Compare Source

What's Changed

• docs: highlight untrusted git-arg interpolation as a warning callout by @​EndBug in #​781
• fix: Remove GH var interpolation in action.yml docstring by @​dzcode in #​783
• fix: validate denylisted git args on every token by @​EndBug in #​784

New Contributors

• @​dzcode made their first contribution in #​783

Full Changelog: EndBug/add-and-commit@v11.1.0...v11.1.1

v11.1.0

Compare Source

What's Changed

• feat: add push_attempts to retry failed pushes by @​EndBug in #​764
• test: add integration tests for the shipped action by @​EndBug in #​766
• feat: add dry_run input by @​EndBug in #​765
• docs: add nmattia as a contributor for ideas by @​allcontributors[bot] in #​767
• docs: add jcbhmr as a contributor for ideas by @​allcontributors[bot] in #​768
• fix: reject remote-helper overrides skipped by -u by @​EndBug in #​770
• fix: block scheme:: remote helpers and restrict git transports by @​EndBug in #​771
• fix: resolve absolute cwd without dumping the minified bundle (#​495) by @​EndBug in #​772
• feat: treat pull: true as a default git pull by @​EndBug in #​773
• docs: add ross-spencer as a contributor for bug by @​allcontributors[bot] in #​774
• docs: add louisabraham as a contributor for ideas by @​allcontributors[bot] in #​775
• fix: reject --pathspec-from-file to prevent log disclosure by @​EndBug in #​777
• fix: neutralize workflow-command injection in info logs by @​EndBug in #​776
• fix: reject glued quotes that string-argv would split into extra git flags by @​EndBug in #​778
• chore(deps): bump js-yaml from 5.2.3 to 5.3.0 by @​dependabot[bot] in #​780
• chore(deps-dev): bump @​vercel/ncc from 0.44.1 to 0.45.0 by @​dependabot[bot] in #​779

Full Changelog: EndBug/add-and-commit@v11.0.0...v11.1.0

v11.0.0

Compare Source

What's Changed

• chore(deps): bump picomatch by @​dependabot[bot] in #​724
• chore(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by @​dependabot[bot] in #​725
• chore(deps): bump lodash from 4.17.23 to 4.18.1 by @​dependabot[bot] in #​728
• chore(deps-dev): bump ts-jest from 29.4.6 to 29.4.9 by @​dependabot[bot] in #​727
• chore(deps): bump @​actions/github from 9.0.0 to 9.1.0 by @​dependabot[bot] in #​729
• chore(deps): bump @​actions/github from 9.1.0 to 9.1.1 by @​dependabot[bot] in #​732
• chore(deps): bump @​actions/core from 3.0.0 to 3.0.1 by @​dependabot[bot] in #​733
• ci(deps): bump actions/dependency-review-action from 4 to 5 by @​dependabot[bot] in #​734
• chore(deps-dev): bump ts-jest from 29.4.9 to 29.4.11 by @​dependabot[bot] in #​736
• chore(deps-dev): bump jest from 30.3.0 to 30.4.2 by @​dependabot[bot] in #​735
• chore(deps-dev): bump eslint-plugin-prettier from 5.5.5 to 5.5.6 by @​dependabot[bot] in #​738
• chore(deps): bump js-yaml from 4.1.1 to 4.2.0 by @​dependabot[bot] in #​739
• ci(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​741
• chore(deps): bump undici from 6.24.1 to 6.27.0 by @​dependabot[bot] in #​744
• ci(deps): bump actions/setup-node from 6 to 7 by @​dependabot[bot] in #​749
• chore(deps-dev): bump @​vercel/ncc from 0.38.4 to 0.44.1 by @​dependabot[bot] in #​746
• chore(deps): bump js-yaml from 4.2.0 to 5.2.1 by @​dependabot[bot] in #​747
• chore(deps-dev): bump ts-jest from 29.4.11 to 29.4.12 by @​dependabot[bot] in #​750
• chore(deps): bump js-yaml from 5.2.1 to 5.2.2 by @​dependabot[bot] in #​751
• chore(deps): bump undici from 6.27.0 to 6.28.0 by @​dependabot[bot] in #​753
• fix: reject remote-helper git flags that enable RCE by @​EndBug in #​754
• fix: prevent git option injection via new_branch by @​EndBug in #​755
• fix: verify committed lib/ matches source in CI by @​EndBug in #​756
• fix: stop logging full git config (credential leak) by @​EndBug in #​758
• fix: reject -F/--file git args that can exfiltrate runner files by @​EndBug in #​759
• fix: reject unmatched quotes in matchGitArgs to prevent flag injection by @​EndBug in #​760
• fix: refuse unexpected gitlinks staged by git add by @​EndBug in #​761
• fix: do not report committed=true for empty commit SHA by @​EndBug in #​757
• ci: pin actions-tagger and restrict release workflow permissions by @​EndBug in #​762
• fix: neutralize bidi and control chars in action logs by @​EndBug in #​763

Full Changelog: EndBug/add-and-commit@v10.0.0...v11.0.0

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v6.1.0

Compare Source

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

astral-sh/setup-uv (astral-sh/setup-uv)

v10.0.1: 🌈 Tolerate transient manifest timeouts

Compare Source

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes

• Tolerate transient manifest timeouts @​arguile- (#​1016)

🧰 Maintenance

• chore: update known checksums for 0.12.4 @​github-actions[bot] (#​1017)

📚 Documentation

• docs: update version references to v10.0.0 @​github-actions[bot] (#​1014)

v10.0.0: 🌈 Disable automatic caching for sensitive events and new QOL features

Compare Source

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

• pull_request_target
• workflow_run
• release

You can read the full reasoning in #​984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes

• Disable automatic caching for sensitive events @​eifinger (#​992)

🐛 Bug fixes

• Reject paths in .tool-versions @​eifinger (#​1007)

🚀 Enhancements

• Read Python version from .tool-versions @​eifinger (#​996)
• Add latest-known version selector @​eifinger (#​993)

🧰 Maintenance

• Require pull requests for Dependabot rollups @​eifinger (#​1005)
• ci: pin Alpine container image @​eifinger (#​995)
• chore: update known checksums for 0.12.3 @​github-actions[bot] (#​991)
• chore: update known checksums for 0.12.2 @​github-actions[bot] (#​985)
• chore: update known checksums for 0.12.1 @​github-actions[bot] (#​982)
• chore: update known checksums for 0.12.0 @​github-actions[bot] (#​981)
• chore: update known checksums for 0.11.31/0.11.32 @​github-actions[bot] (#​972)

📚 Documentation

• docs: update version references to v9.0.0 @​github-actions[bot] (#​971)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @​eifinger (#​1013)
• chore(deps): roll up Dependabot updates @​eifinger (#​1004)
• chore(deps): roll up Dependabot updates @​eifinger (#​994)
• chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 @​dependabot[bot] (#​976)
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 @​dependabot[bot] (#​980)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on tuesday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.