chore(deps): update all non-major dependencies

[renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
actions/dependency-review-action	action	minor	v4.5.0 -> v4.7.1
actions/setup-go	action	minor	v5.3.0 -> v5.5.0
github/codeql-action	action	minor	v3.28.10 -> v3.29.0
go	uses-with	minor	1.20 -> 1.24
ossf/scorecard-action	action	patch	v2.4.1 -> v2.4.2
step-security/harden-runner	action	minor	v2.11.0 -> v2.12.1

---

Release Notes

actions/dependency-review-action (actions/dependency-review-action)

v4.7.1

Compare Source

• Packages added to allow-dependencies-licenses will be allowed even if the package in question has no license information #​889
• License expressions (e.g. Ruby OR GPL-2.0) in the allow list are automatically discarded so that they don't invalidate the whole allow list, which should just be license identifier (e.g. Ruby)

v4.7.0

Compare Source

• Handle complex license expressions (e.g. MIT AND GPL-2.0) in allow lists (fixes #​809 and probably others)
• Replace OTHER in package licenses with LicenseRef-clearlydefined-OTHER so that parsing passes

v4.6.0

Compare Source

What's Changed

• Updating multiple dependency versions by @​Ahmed3lmallah in https://github.com/actions/dependency-review-action/pull/870
• Grouping minor and patch dependabot updates to lessen the number of PRs by @​Ahmed3lmallah in https://github.com/actions/dependency-review-action/pull/876
• Bump actions/stale from 9.0.0 to 9.1.0 by @​dependabot in https://github.com/actions/dependency-review-action/pull/878
• Bump undici from 5.28.4 to 5.28.5 by @​dependabot in https://github.com/actions/dependency-review-action/pull/877
• DR Action should link to the proxima stamp when appropriate in error messages by @​AshelyTC in https://github.com/actions/dependency-review-action/pull/891
• Allow deny package removal by @​ellenfieldn in https://github.com/actions/dependency-review-action/pull/888
• Fix typos by @​omahs in https://github.com/actions/dependency-review-action/pull/893
• Bump esbuild from 0.19.5 to 0.25.0 by @​dependabot in https://github.com/actions/dependency-review-action/pull/900
• Bump octokit and related dependencies by @​RomanIakovlev in https://github.com/actions/dependency-review-action/pull/904
• Bump @​babel/helpers from 7.23.2 to 7.26.10 by @​dependabot in https://github.com/actions/dependency-review-action/pull/905
• Bump @​octokit/plugin-paginate-rest from 9.1.5 to 9.2.2 by @​dependabot in https://github.com/actions/dependency-review-action/pull/899
• Update transitive dependency spdx-license-ids by @​ailox in https://github.com/actions/dependency-review-action/pull/855
• To not print OpenSSF Scorecard section if no dependencies scanned by @​fabasoad in https://github.com/actions/dependency-review-action/pull/884
• Improve usage of this action in dependency-review.yml by @​fabasoad in https://github.com/actions/dependency-review-action/pull/883
• Clarify comment-summary-in-pr behaviour by @​Pantelis-Santorinios in https://github.com/actions/dependency-review-action/pull/902
• Prepare 4.6.0 Release candidate by @​brrygrdn in https://github.com/actions/dependency-review-action/pull/910

New Contributors

• @​AshelyTC made their first contribution in https://github.com/actions/dependency-review-action/pull/891
• @​ellenfieldn made their first contribution in https://github.com/actions/dependency-review-action/pull/888
• @​omahs made their first contribution in https://github.com/actions/dependency-review-action/pull/893
• @​RomanIakovlev made their first contribution in https://github.com/actions/dependency-review-action/pull/904
• @​ailox made their first contribution in https://github.com/actions/dependency-review-action/pull/855
• @​fabasoad made their first contribution in https://github.com/actions/dependency-review-action/pull/884
• @​Pantelis-Santorinios made their first contribution in https://github.com/actions/dependency-review-action/pull/902
• @​brrygrdn made their first contribution in https://github.com/actions/dependency-review-action/pull/910

Full Changelog: actions/dependency-review-action@v4.5.0...v4.6.0

actions/setup-go (actions/setup-go)

v5.5.0

Compare Source

What's Changed

Bug fixes:

• Update self-hosted environment validation by @​priyagupta108 in https://github.com/actions/setup-go/pull/556
• Add manifest validation and improve error handling by @​priyagupta108 in https://github.com/actions/setup-go/pull/586
• Update template link by @​jsoref in https://github.com/actions/setup-go/pull/527

Dependency updates:

• Upgrade @​action/cache from 4.0.2 to 4.0.3 by @​aparnajyothi-y in https://github.com/actions/setup-go/pull/574
• Upgrade @​actions/glob from 0.4.0 to 0.5.0 by @​dependabot in https://github.com/actions/setup-go/pull/573
• Upgrade ts-jest from 29.1.2 to 29.3.2 by @​dependabot in https://github.com/actions/setup-go/pull/582
• Upgrade eslint-plugin-jest from 27.9.0 to 28.11.0 by @​dependabot in https://github.com/actions/setup-go/pull/537

New Contributors

• @​jsoref made their first contribution in https://github.com/actions/setup-go/pull/527

Full Changelog: actions/setup-go@v5...v5.5.0

v5.4.0

Compare Source

What's Changed

Dependency updates :

• Upgrade semver from 7.6.0 to 7.6.3 by @​dependabot in https://github.com/actions/setup-go/pull/535
• Upgrade eslint-config-prettier from 8.10.0 to 10.0.1 by @​dependabot in https://github.com/actions/setup-go/pull/536
• Upgrade @​action/cache from 4.0.0 to 4.0.2 by @​aparnajyothi-y in https://github.com/actions/setup-go/pull/568
• Upgrade undici from 5.28.4 to 5.28.5 by @​dependabot in https://github.com/actions/setup-go/pull/541

New Contributors

• @​aparnajyothi-y made their first contribution in https://github.com/actions/setup-go/pull/568

Full Changelog: actions/setup-go@v5...v5.4.0

github/codeql-action (github/codeql-action)

v3.29.0

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.0 - 11 Jun 2025

• Update default CodeQL bundle version to 2.22.0. #​2925
• Bump minimum CodeQL bundle version to 2.16.6. #​2912

See the full CHANGELOG.md for more information.

v3.28.19

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.19 - 03 Jun 2025

• The CodeQL Action no longer includes its own copy of the extractor for the actions language, which is currently in public preview.
  The actions extractor has been included in the CodeQL CLI since v2.20.6. If your workflow has enabled the actions language and you have pinned
  your tools: property to a specific version of the CodeQL CLI earlier than v2.20.6, you will need to update to at least CodeQL v2.20.6 or disable
  actions analysis.
• Update default CodeQL bundle version to 2.21.4. #​2910

See the full CHANGELOG.md for more information.

v3.28.18

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.18 - 16 May 2025

• Update default CodeQL bundle version to 2.21.3. #​2893
• Skip validating SARIF produced by CodeQL for improved performance. #​2894
• The number of threads and amount of RAM used by CodeQL can now be set via the CODEQL_THREADS and CODEQL_RAM runner environment variables. If set, these environment variables override the threads and ram inputs respectively. #​2891

See the full CHANGELOG.md for more information.

v3.28.17

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.17 - 02 May 2025

• Update default CodeQL bundle version to 2.21.2. #​2872

See the full CHANGELOG.md for more information.

v3.28.16

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.16 - 23 Apr 2025

• Update default CodeQL bundle version to 2.21.1. #​2863

See the full CHANGELOG.md for more information.

v3.28.15

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.15 - 07 Apr 2025

• Fix bug where the action would fail if it tried to produce a debug artifact with more than 65535 files. #​2842

See the full CHANGELOG.md for more information.

v3.28.14

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.14 - 07 Apr 2025

• Update default CodeQL bundle version to 2.21.0. #​2838

See the full CHANGELOG.md for more information.

v3.28.13

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.13 - 24 Mar 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.28.12

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.12 - 19 Mar 2025

• Dependency caching should now cache more dependencies for Java build-mode: none extractions. This should speed up workflows and avoid inconsistent alerts in some cases.
• Update default CodeQL bundle version to 2.20.7. #​2810

See the full CHANGELOG.md for more information.

v3.28.11

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.11 - 07 Mar 2025

• Update default CodeQL bundle version to 2.20.6. #​2793

See the full CHANGELOG.md for more information.

actions/go-versions (go)

v1.24.4: 1.24.4

Compare Source

Go 1.24.4

v1.24.3: 1.24.3

Compare Source

Go 1.24.3

v1.24.2: 1.24.2

Compare Source

Go 1.24.2

v1.24.1: 1.24.1

Compare Source

Go 1.24.1

v1.24.0: 1.24.0

Compare Source

Go 1.24.0

v1.23.10: 1.23.10

Compare Source

Go 1.23.10

v1.23.9: 1.23.9

Compare Source

Go 1.23.9

v1.23.8: 1.23.8

Compare Source

Go 1.23.8

v1.23.7: 1.23.7

Compare Source

Go 1.23.7

v1.23.6: 1.23.6

Compare Source

Go 1.23.6

v1.23.5: 1.23.5

Compare Source

Go 1.23.5

v1.23.4: 1.23.4

Compare Source

Go 1.23.4

v1.23.3: 1.23.3

Compare Source

Go 1.23.3

v1.23.2: 1.23.2

Compare Source

Go 1.23.2

v1.23.1: 1.23.1

Compare Source

Go 1.23.1

v1.23.0: 1.23.0

Compare Source

Go 1.23.0

v1.22.12: 1.22.12

Compare Source

Go 1.22.12

v1.22.11: 1.22.11

Compare Source

Go 1.22.11

v1.22.10: 1.22.10

Compare Source

Go 1.22.10

v1.22.9: 1.22.9

Compare Source

Go 1.22.9

v1.22.8: 1.22.8

Compare Source

Go 1.22.8

v1.22.7: 1.22.7

Compare Source

Go 1.22.7

v1.22.6: 1.22.6

Compare Source

Go 1.22.6

v1.22.5: 1.22.5

Compare Source

Go 1.22.5

v1.22.4: 1.22.4

Compare Source

Go 1.22.4

v1.22.3: 1.22.3

Compare Source

Go 1.22.3

v1.22.2: 1.22.2

Compare Source

Go 1.22.2

v1.22.1: 1.22.1

Compare Source

Go 1.22.1

v1.22.0: 1.22.0

Compare Source

Go 1.22.0

v1.21.13: 1.21.13

Compare Source

Go 1.21.13

v1.21.12: 1.21.12

Compare Source

Go 1.21.12

v1.21.11: 1.21.11

Compare Source

Go 1.21.11

v1.21.10: 1.21.10

Compare Source

Go 1.21.10

v1.21.9: 1.21.9

Compare Source

Go 1.21.9

v1.21.8: 1.21.8

Compare Source

Go 1.21.8

v1.21.7: 1.21.7

Compare Source

Go 1.21.7

v1.21.6: 1.21.6

Compare Source

Go 1.21.6

v1.21.5: 1.21.5

Compare Source

Go 1.21.5

v1.21.4: 1.21.4

Compare Source

Go 1.21.4

v1.21.3: 1.21.3

Compare Source

Go 1.21.3

v1.21.2: 1.21.2

Compare Source

Go 1.21.2

v1.21.1: 1.21.1

Compare Source

Go 1.21.1

v1.21.0: 1.21.0

Compare Source

Go 1.21.0

ossf/scorecard-action (ossf/scorecard-action)

v2.4.2

Compare Source

What's Changed

This update bumps the Scorecard version to the v5.2.1 release. For a complete list of changes, please refer to the Scorecard v5.2.0 and v5.2.1 release notes.

Full Changelog: ossf/scorecard-action@v2.4.1...v2.4.2

step-security/harden-runner (step-security/harden-runner)

v2.12.1

Compare Source

What's Changed

• Detection capabilities have been upgraded to better recognize attempts at runner tampering. These improvements are informed by real-world incident learnings, including analysis of anomalous behaviors observed in the tj-actions and reviewdog supply chain attack.
• Resolved an issue where the block policy was not enforced correctly when the GitHub Actions job was running inside a container on a self-hosted VM runner.

Full Changelog: step-security/harden-runner@v2...v2.12.1

v2.12.0

Compare Source

What's Changed

1. A new option, disable-sudo-and-containers, is now available to replace the disable-sudo policy, addressing Docker-based privilege escalation (CVE-2025-32955). More details can be found in this blog post.

2. New detections have been added based on insights from the tj-actions and reviewdog actions incidents.

Full Changelog: step-security/harden-runner@v2...v2.12.0

v2.11.1

Compare Source

What's Changed

• cache: add support for GitHub Actions cache v2 by @​h0x0er in https://github.com/step-security/harden-runner/pull/529

Full Changelog: step-security/harden-runner@v2...v2.11.1

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month ( * 0-3 1 * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.