Skip to content

chore(deps): update github actions - #363

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions
Open

chore(deps): update github actions#363
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions

Conversation

@renovate

@renovate renovate Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence Type Update
copier 9.16.09.17.1 age confidence minor
docker/login-action v4.2.0v4.6.0 age confidence action minor
docker/setup-buildx-action (changelog) d7f5e7fbb05f3f action digest
go-task/task 3.51.13.52.0 age confidence minor
koalaman/shellcheck 0.10.00.11.0 age confidence minor
mikefarah/yq 4.44.34.53.3 age confidence minor
python 3.133.14 age confidence uses-with minor
snyk 1.1305.21.1306.3 age confidence minor

Release Notes

copier-org/copier (copier)

v9.17.1

Compare Source

Security
  • prevent code execution via Jinja finalizer by disallowing YAML tags
  • prevent code execution via Jinja sandbox escape through path and settings objects

v9.17.0

Compare Source

Feat
  • add --ask flag to force prompting of selected questions (#​2705)
Security
  • prevent trust bypass via encoded URL traversal
docker/login-action (docker/login-action)

v4.6.0

Compare Source

v4.5.2

Compare Source

v4.5.1

Compare Source

v4.5.0

Compare Source

v4.4.0

Compare Source

v4.3.0

Compare Source

Full Changelog: docker/login-action@v4.2.0...v4.3.0

go-task/task (go-task/task)

v3.52.0

Compare Source

  • Fixed --interactive prompts for required vars sometimes appearing in a random
    order. Prompts now follow the order the vars are declared in the Taskfile.
    (#​2871 by @​caproven)
  • Fixed Fish completions not being picked up correctly by installing them to
    Fish's vendor_completions.d directory instead of completions (#​2850, #​2859
    by @​Legimity).
  • PowerShell completions now work with aliases of the task command, not just
    the task binary itself (#​2852 by @​kojiishi).
  • Fixed task and namespace aliases not being completed by the Zsh completion. A
    show-aliases zstyle can turn this off (#​2865, #​2864 by @​vmaerten).
  • Fixed task names containing certain characters (e.g. \, _, ^) leaking
    into checksum/timestamp filenames, breaking sources:/generates: up-to-date
    detection (#​2886 by @​s3onghyun).
  • Fixed for: matrix: loops using ref: rows producing wrong values when the
    same task was run concurrently (e.g. by parallel deps) with different vars
    (#​2890, #​2894 by @​amitmishra11).
  • Added a secret: true flag for variables that masks their value in logs,
    task --summary, and command output (#​2514 by @​vmaerten).
  • Added the use_gitignore setting (global or per-task) to skip files matched
    by your .gitignore when fingerprinting sources/generates and when
    watching (#​2773 by @​vmaerten).
  • Added support for configuring output flags (--output,
    --output-group-begin, --output-group-end, --output-group-error-only) via
    the TASK_OUTPUT* environment variables (#​2873 by @​liiight).
  • Added a --temp-dir flag (with TASK_TEMP_DIR env var and temp-dir taskrc
    config) to customise the directory where Task stores temporary files such as
    checksums. Relative paths are resolved against the root Taskfile (#​2891 by
    @​kjasn).
  • Defined environment variable behavior for remote taskfiles (#​2267, #​2847 by
    @​vmaerten).
  • Added support for remote Taskfiles hosted on Azure DevOps, whose git URLs use
    a /_git/ path segment rather than a .git suffix (#​2904 by @​pd93).
  • Re-added the example remote taskfile at
    taskfile.dev/Taskfile.yml (#​2905 by
    @​pd93).
  • Fixed malformed includes: entries (missing taskfile/dir) reporting a
    misleading "include cycle detected" error instead of a clear configuration
    error (#​1881, #​2892 by @​Lewin671).
koalaman/shellcheck (koalaman/shellcheck)

v0.11.0

Compare Source

Added
  • SC2327/SC2328: Warn about capturing the output of redirected commands.
  • SC2329: Warn when (non-escaping) functions are never invoked.
  • SC2330: Warn about unsupported glob matches with [[ .. ]] in BusyBox.
  • SC2331: Suggest using standard -e instead of unary -a in tests.
  • SC2332: Warn about [ ! -o opt ] being unconditionally true in Bash.
  • SC3062: Warn about bashism [ -o opt ].
  • Optional avoid-negated-conditions: suggest replacing [ ! a -eq b ]
    with [ a -ne b ], and similar for -ge/-lt/=/!=/etc (SC2335).
  • Precompiled binaries for Linux riscv64 (linux.riscv64)
Changed
  • SC2002 about Useless Use Of Cat is now disabled by default. It can be
    re-enabled with --enable=useless-use-of-cat or equivalent directive.
  • SC2236/SC2237 about replacing [ ! -n .. ] with [ -z ] and vice versa
    is now optional under avoid-negated-conditions.
  • SC2015 about A && B || C no longer triggers when B is a test command.
  • SC3012: Do not warn about \< and \> in test/[] as specified in POSIX.1-2024
  • Diff output now uses / as path separator on Windows
Fixed
  • SC2218 about function use-before-define is now more accurate.
  • SC2317 about unreachable commands is now less spammy for nested ones.
  • SC2292, optional suggestion for [[ ]], now triggers for Busybox.
  • Updates for Bash 5.3, including ${| cmd; } and source -p
Removed
  • SC3013: removed since the operators -ot/-nt/-ef are specified in POSIX.1-2024
mikefarah/yq (mikefarah/yq)

v4.53.3

Compare Source

v4.53.2

Compare Source

  • Releases and tags now signed and immutable!
  • Add system(command; args) operator (disabled by default) (#​2640)
  • TOML encoder: prefer readable table sections over inline tables (#​2649)
  • Fix TOML encoder to quote keys containing special characters (#​2648)
  • Add string slicing support (#​2639)
  • Fix findInArray misuse on MappingNodes in equality and contains (#​2645) Thanks @​jandubois!
  • Fix panic on negative slice indices that underflow after adjustment (#​2646) Thanks @​jandubois!
  • Fix stack overflow from circular alias in traverse (#​2647) Thanks @​jandubois!
  • Fix panic and OOM in repeatString for large repeat counts (#​2644) Thanks @​jandubois!
  • Bumped dependencies

v4.52.5

Compare Source

v4.52.4

Compare Source

  • Dropping windows/arm - no longer supported in cross-compile
    • Fixing comments in TOML arrays (#​2592)
    • Bumped dependencies

v4.52.2

Compare Source

v4.52.1: - TOML roundtrip and more!

Compare Source

  • TOML encoder support - you can now roundtrip! #​1364
    • Parent now supports negative indices, and added a 'root' command for referencing the top level document

    • Fixed scalar encoding for HCL

    • Add --yaml-compact-seq-indent / -c flag for compact sequence indentation (#​2583) Thanks @​jfenal

    • Add symlink check to file rename util (#​2576) Thanks @​Elias-elastisys

    • Powershell fixed default command used for __completeNoDesc alias (#​2568) Thanks @​teejaded

    • Unwrap scalars in shell output mode. (#​2548) Thanks @​flintwinters

    • Added K8S KYAML output format support (#​2560) Thanks @​robbat2

    • Bumped dependencies

    • Special shout out to @​ccoVeille for reviewing my PRs!

Thanks to everyone that contributed ❤️

v4.50.1: - HCL!

Compare Source

  • Added HCL Support - First cut - hopefully it works well! (#​1844)
  • Fixing handling of CRLF #​2352
  • Bumped dependencies

v4.49.2

Compare Source

v4.49.1: - Security Flags and TOML fixes

Compare Source

  • Added --security flags to disable env and file ops #​2515
    • Fixing TOML ArrayTable parsing issues #​1758
    • Fixing parsing of escaped characters #​2506

v4.48.2

Compare Source

v4.48.1: - First and Parents Operators

Compare Source

  • Added 'parents' operator, to return a list of all the hierarchical parents of a node
    • Added 'first(exp)' operator, to return the first entry matching an expression in an array
    • Fixed xml namespace prefixes #​1730 (thanks @​baodrate)
    • Fixed out of range panic in yaml decoder #​2460 (thanks @​n471d)
    • Bumped dependencies

v4.47.2

Compare Source

v4.47.1: - Merge Anchor fixes (with flag)

Compare Source

v4.46.1: - INI support + bug fixes

Compare Source

v4.45.4: - Fixing wrong map() behaviour on empty map

Compare Source

  • Fixing wrong map() behaviour on empty map #​2359
  • Bumped dependencies

v4.45.3: - Fixes regression bug(s)

Compare Source

Sorry for the regression folks! 😓
fwiw I have since added automated tests to capture the scenarios provided in the regression bug tickets

v4.45.2

Compare Source

v4.45.1: - Create parent directories when --split-exp is used!

Compare Source

  • Create parent directories when --split-exp is used, Thanks @​rudo-thomas
    • Bumped dependencies

v4.44.6

Compare Source

v4.44.5

Compare Source

  • Format comments with a gray foreground (Thanks @​gabe565)
  • Fixed handling of nulls with sort_by expressions #​2164
  • Force no color output when NO_COLOR env presents (Thanks @​narqo)
  • Fixed array subtraction update bug #​2159
  • Fixed index out of range error
  • Can traverse straight from parent operator (parent.blah)
  • Bumped dependencies

Note: 4.44.4 was skipped as it had a release pipeline failure

actions/python-versions (python)

v3.14.7: 3.14.7

Compare Source

Python 3.14.7

v3.14.6: 3.14.6

Compare Source

Python 3.14.6

v3.14.5: 3.14.5

Compare Source

Python 3.14.5

v3.14.4: 3.14.4

Compare Source

Python 3.14.4

v3.14.3: 3.14.3

Compare Source

Python 3.14.3

v3.14.2: 3.14.2

Compare Source

Python 3.14.2

v3.14.1: 3.14.1

Compare Source

Python 3.14.1

v3.14.0: 3.14.0

Compare Source

Python 3.14.0

snyk/snyk (snyk)

v1.1306.3

Compare Source

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their
needs. For details please see this documentation

Bug Fixes

v1.1306.2

Compare Source

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their
needs. For details please see this documentation

Bug Fixes
  • language-server: Improved authentication handling in the Snyk Language Server, which powers Snyk's IDE integrations. (3afb07a)
  • deps: Updates dependencies to fix vulnerabilities:
    • SNYK-GOLANG-GOOGLEGOLANGORGGRPCINTERNALXDSRBAC-18172577 (11d1660)

v1.1306.1

Compare Source

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their
needs. For details please see this documentation

Bug Fixes

v1.1306.0

Compare Source

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Features
  • doctor: Adds the snyk doctor command to diagnose common CLI problems: generate a diagnostic report for the current system, or analyze debug log output. (ab56a0e)
  • container: Container scans now detect the Java runtime version across a wider range of JVM base images, and can now find vulnerabilities in .NET application dependencies. (5586aac)
  • mcp: The breakability evaluation tool in the Snyk MCP Server is now enabled by default and no longer requires an experimental flag. (56a9196)
  • test: Improves dependency detection for Gradle projects. (c819b69)
  • redteam: The experimental snyk redteam command has been removed from the CLI, following its deprecation (deprecation date May 31, 2026). (c7d0e3e)
Bug Fixes
  • general: Shows a warning when a request is automatically retried due to rate limiting, instead of retrying silently. (f803397)
  • general: Skips the reachability upload when no supported files are present, instead of failing. (9ba448c)
  • test: Fixes dependency resolution for Swift Package Manager projects that reference packages by registry identity, so they're correctly matched to their GitHub source for vulnerability scanning. (64ac442)
  • test: Fixes scanning of sbt projects with custom Scala configurations. (5765a12)
  • test: Fixes a bug where scanning Yarn workspaces could report vulnerabilities from a workspace member's dev dependencies as if they were production dependencies, when that member was consumed by a sibling package. (ade08e4)
  • deps: Updates dependencies to fix vulnerabilities:

Configuration

📅 Schedule: (in timezone America/Chicago)

  • Branch creation
    • "before 9am on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from evanharmon1 as a code owner August 10, 2026 10:45
@renovate
renovate Bot force-pushed the renovate/github-actions branch from d6e3f47 to 79f1692 Compare August 10, 2026 13:19
@renovate
renovate Bot force-pushed the renovate/github-actions branch from 79f1692 to f8f22f3 Compare August 11, 2026 13:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants