chore(deps): update github-actions dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
actions/attest-build-provenance	v4.1.1 → v4.2.2
actions/checkout	v7.0.0 → v7.0.1
actions/labeler	v6.1.0 → v6.2.0
actions/setup-node	v6.4.0 → v6.5.0
actions/stale	v10.3.0 → v10.4.0
denoland/setup-deno	v2.0.4 → v2.0.5
dorny/paths-filter	v4.0.1 → v4.0.3
github/codeql-action	v4.36.2 → v4.37.6
ossf/scorecard-action	v2.4.3 → v2.4.4
pnpm/action-setup	v6.0.9 → v6.0.10
step-security/harden-runner	v2.19.4 → v2.20.1
zizmorcore/zizmor-action	v0.5.7 → v0.6.2

---

Release Notes

actions/attest-build-provenance (actions/attest-build-provenance)

v4.2.2

Compare Source

[!NOTE]
As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

• Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group by @​dependabot[bot] in #​862

Full Changelog: actions/attest-build-provenance@v4.1.1...v4.2.2

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

actions/labeler (actions/labeler)

v6.2.0

Compare Source

What's Changed

Bug Fix

• Improve PR number validation and warning messages in input handling by @​chiranjib-swain in #​939

Dependency Updates

• Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override by @​dependabot in #​943
• Bump @​typescript-eslint/eslint-plugin from 8.59.1 to 8.61.1 by @​dependabot in #​942

Full Changelog: actions/labeler@v6.1.0...v6.2.0

actions/setup-node (actions/setup-node)

v6.5.0

Compare Source

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in #​1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

actions/stale (actions/stale)

v10.4.0

Compare Source

What's Changed

Bug Fix

• Fixed only-issue-types validation by @​trueberryless in #​1338

Dependency Updates

• Bump undici to 6.27.0 via override, clean up stale license files, and version to 10.4.0. by @​dependabot in #​1342

New Contributors

• @​trueberryless made their first contribution in #​1338

Full Changelog: actions/stale@v10.3.0...v10.4.0

denoland/setup-deno (denoland/setup-deno)

v2.0.5

Compare Source

What's Changed

• fix: update README and tests by @​crowlKats in #​85
• 2.0.1 by @​crowlKats in #​86
• Add problem matchers for deno lint by @​r7kamura in #​62
• refactor: use GitHub downloads for stable version download by @​crowlKats in #​91
• 2.0.2 by @​crowlKats in #​92
• refactor: convert action to TS and bundle code by @​csvn in #​95
• feat: add "lts" version option by @​sebdanielsson in #​97
• feat: add built-in caching via inputs by @​csvn in #​89
• feat: include a hash of deno.lock files in the cache key automatically by @​dsherret in #​98
• fix: switch back to package.json as it's necessary for GH actions by @​dsherret in #​101
• 2.0.3 by @​crowlKats in #​102
• Update actions/checkout by @​katayama8000 in #​106
• docs: add lts as possible release-channel output by @​csvn in #​99
• docs: condense Deno version information in one section by @​csvn in #​100
• docs: fix identifier for latest stable release by @​Ms2ger in #​115
• feat: upgrade Node.js runtime from node20 to node24 by @​nikicat in #​123
• 2.0.4 by @​crowlKats in #​125
• chore: use versions.json from dl.deno.land by @​crowlKats in #​130
• 2.0.5 by @​crowlKats in #​131

New Contributors

• @​r7kamura made their first contribution in #​62
• @​csvn made their first contribution in #​95
• @​sebdanielsson made their first contribution in #​97
• @​katayama8000 made their first contribution in #​106
• @​Ms2ger made their first contribution in #​115
• @​nikicat made their first contribution in #​123

Full Changelog: denoland/setup-deno@v2.0.0...v2.0.5

dorny/paths-filter (dorny/paths-filter)

v4.0.3

Compare Source

• Document safe handling of file list outputs in workflows
• Escape multi-line filenames in list-files shell and csv output
• Add 'some-with-excludes' predicate quantifier
• Add contents permission to PR example
• Scope base-ignored warning to API path
• Update outputs in readme to account for the 'every' predicate-quantifier

v4.0.2

Compare Source

• Work around git dubious ownership errors in container jobs
• Use rev-parse instead of branch --show-current for older git compat
• Fix warning message

github/codeql-action (github/codeql-action)

v4.37.6

Compare Source

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #​4070

v4.37.5

Compare Source

v4.37.4

Compare Source

v4.37.3

Compare Source

No user facing changes.

v4.37.2

Compare Source

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #​4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #​4007

v4.37.1

Compare Source

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #​3956
• Update default CodeQL bundle version to 2.26.1. #​4019

v4.37.0

Compare Source

• Update default CodeQL bundle version to 2.26.0. #​3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #​3973

v4.36.3

Compare Source

No user facing changes.

ossf/scorecard-action (ossf/scorecard-action)

v2.4.4

Compare Source

What's Changed

This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the Scorecard v5.4.0 release notes and the Scorecard v5.5.0 release notes.

• log POST failures instead of failing entire action by @​spencerschrock in #​1625

Full Changelog: ossf/scorecard-action@v2.4.3...v2.4.4

pnpm/action-setup (pnpm/action-setup)

v6.0.10

Compare Source

step-security/harden-runner (step-security/harden-runner)

v2.20.1

Compare Source

What's Changed

• AWS CodeBuild-hosted runner support
• Implicitly allow single-labeled (internal) domains in block-mode

Full Changelog: step-security/harden-runner@v2.20.0...v2.20.1

v2.20.0

Compare Source

What's Changed

• Support for block policy for MacOS and Windows GitHub-hosted runners
• Support for Bitrise MacOS GitHub Actions runners
• HTTPS monitoring support for Bun for Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.19.4...v2.20.0

zizmorcore/zizmor-action (zizmorcore/zizmor-action)

v0.6.2

Compare Source

zizmor 1.29.0 is now the default version.

v0.6.1

Compare Source

zizmor 1.28.0 is now the default version used by the action.

v0.6.0

Compare Source

zizmor 1.27.0 is now the default version used by the action.

What's Changed

• Fold Docker image pull output into a collapsed Actions log group by @​woodruffw with @​Copilot in #​132
• Readme: document missing inputs by @​staabm in #​130
• ci: block version sync workflow on forks by @​shaanmajid in #​129
• Sync zizmor versions by @​github-actions[bot] in #​137
• Add collect input by @​woodruffw in #​139

New Contributors

• @​woodruffw with @​Copilot made their first contribution in #​132
• @​staabm made their first contribution in #​130
• @​shaanmajid made their first contribution in #​129

Full Changelog: zizmorcore/zizmor-action@v0.5.7...v0.6.0

---

Configuration

📅 Schedule: (in timezone Asia/Kolkata)

• Branch creation
  • "on the first day of the month"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.