chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #282 · chgl/.github

renovate · 2026-10-12T01:56:36Z

This PR contains the following updates:

Package	Type	Update	Change
actions/download-artifact	action	patch	`v8.0.1` → `v8.0.2`
actions/setup-node	action	minor	`v7.0.0` → `v7.1.0`
actions/upload-artifact	action	patch	`v7.0.1` → `v7.0.2`
github/codeql-action	action	patch	`v4.38.2` → `v4.38.3`
step-security/harden-runner	action	minor	`v2.21.1` → `v2.22.1`

Release Notes

actions/download-artifact (actions/download-artifact)

`v8.0.2`

Compare Source

What's Changed

Update the readme by @danwkennedy in #473
Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
Update @actions/artifact to 6.3.1 by @tunc-d in #492
Prepare download-artifact v8.0.2 by @tunc-d in #493

New Contributors

@tunc-d made their first contribution in #492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

actions/setup-node (actions/setup-node)

`v7.1.0`

Compare Source

What's Changed

Enhancements:

Add support for mise.toml file by @gperdomor in #1421
Support absolute paths in node-version-file by @v-mahabaleshwars in #1633

Bug fixes:

Add Node version validation and manifest fetch retry by @v-jitenderpalsingh in #1580

Documentation updates:

README.md: bump actions/checkout to latest version 7 by @deining in #1578
docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by @v-gowridurgad in #1593
Fixed cache recommendation syntax by @SubJunk in #1603

Dependency updates:

Update workflow pins and migrate Node matrices to modern versions by @v-HarithaVattikuti in #1583
Upgrade @actions/cache to 6.2.0 by @philip-gai in #1584
Pin @types/node to v24 by @v-priyagupta108 in #1585
Override brace-expansion to 5.0.8 by @v-priyagupta108 with @Copilot in #1599
Upgrade actions/checkout from 7.0.0 to 7.0.1 by @dependabot in #1598
Upgrade prettier from 3.8.4 to 3.9.6 by @dependabot in #1590
Upgrade @vercel/ncc from 0.44.0 to 0.45.0 by @dependabot in #1610
Upgrade pnpm/action-setup from 6.0.9 to 6.0.10 by @dependabot in #1602
Upgrade baseline-browser-mapping from 2.10.38 to 2.11.22 by @dependabot in #1629
Upgrade @types/semver from 7.7.1 to 7.8.0 by @dependabot in #1616
Upgrade @typescript-eslint/parser from 8.62.0 to 8.70.0 by @dependabot in #1615
Upgrade pnpm/action-setup from 6.0.10 to 6.1.0 by @dependabot in #1631
Upgrade jest-each from 30.4.1 to 30.5.2 by @dependabot in #1636
Upgrade eslint-plugin-n from 18.1.0 to 18.3.0 by @dependabot in #1638
Update dependencies and add license files by @v-HarithaVattikuti in #1642
Upgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by @dependabot in #1635

New Contributors

@v-jitenderpalsingh made their first contribution in #1580
@philip-gai made their first contribution in #1584
@gperdomor made their first contribution in #1421
@SubJunk made their first contribution in #1603

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

actions/upload-artifact (actions/upload-artifact)

`v7.0.2`

Compare Source

What's Changed

Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
Updates @actions/artifact to v6.3.1.

New Contributors

@tunc-d made their first contribution in #821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

github/codeql-action (github/codeql-action)

`v4.38.3`

Compare Source

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
Update default CodeQL bundle version to 2.27.2. #4203
Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

step-security/harden-runner (step-security/harden-runner)

`v2.22.1`

Compare Source

What's Changed

Fixed security rules not initializing on GHES self-hosted runners
Fixed GHES connectivity in block mode by implicitly allowing the GHES hostname

Full Changelog: step-security/harden-runner@v2.22.0...v2.22.1

`v2.22.0`

Compare Source

What's Changed

Linux ARM64 support for community tier
GHES support for self-hosted VMs (enterprise tier)
MacOS and Windows runner deny list support for block policy (enterprise tier).

Full Changelog: step-security/harden-runner@v2.21.1...v2.22.0

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-10-12T02:01:10Z

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	4	0	0	0.19s
✅ ACTION	zizmor	4	0	0	2.89s
✅ COPYPASTE	jscpd	yes	no	no	0.8s
✅ DOCKERFILE	hadolint	1	0	0	0.07s
✅ JSON	jsonlint	3	0	0	0.12s
✅ JSON	prettier	3	0	0	0.5s
✅ JSON	v8r	3	0	0	2.65s
✅ MARKDOWN	markdownlint	1	0	0	0.55s
✅ MARKDOWN	markdown-table-formatter	1	0	0	0.25s
✅ PYTHON	bandit	1	0	0	2.37s
✅ PYTHON	black	1	0	0	1.57s
✅ PYTHON	flake8	1	0	0	1.23s
✅ PYTHON	isort	1	0	0	0.27s
✅ PYTHON	mypy	1	0	0	4.21s
✅ PYTHON	pylint	1	0	0	3.09s
✅ PYTHON	pyright	1	0	0	2.23s
✅ PYTHON	ruff	1	0	0	0.04s
✅ REPOSITORY	betterleaks	yes	no	no	0.89s
✅ REPOSITORY	checkov	yes	no	no	24.15s
✅ REPOSITORY	dustilock	yes	no	no	0.04s
✅ REPOSITORY	git_diff	yes	no	no	0.02s
✅ REPOSITORY	grype	yes	no	no	99.6s
✅ REPOSITORY	kingfisher	yes	no	no	6.11s
✅ REPOSITORY	osv-scanner	yes	no	no	0.19s
✅ REPOSITORY	secretlint	yes	no	no	0.82s
✅ REPOSITORY	syft	yes	no	no	2.41s
✅ REPOSITORY	trivy	yes	no	no	14.19s
✅ REPOSITORY	trivy-sbom	yes	no	no	0.24s
✅ REPOSITORY	trufflehog	yes	no	no	5.03s
✅ YAML	prettier	7	0	0	0.79s
✅ YAML	v8r	7	0	0	8.24s
✅ YAML	yamllint	7	0	0	0.61s

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_KICS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

Documentation: Custom Flavors
Command: npx mega-linter-runner@10.1.0 --custom-flavor-setup --custom-flavor-linters PYTHON_PYLINT,PYTHON_BLACK,PYTHON_FLAKE8,PYTHON_ISORT,PYTHON_BANDIT,PYTHON_MYPY,PYTHON_PYRIGHT,PYTHON_RUFF,ACTION_ACTIONLINT,ACTION_ZIZMOR,COPYPASTE_JSCPD,DOCKERFILE_HADOLINT,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_DUSTILOCK,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,REPOSITORY_KINGFISHER,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository

github-actions · 2026-10-12T05:38:52Z