Skip to content

chore: Update github-actions dependencies - #46

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions-dependencies
Open

chore: Update github-actions dependencies#46
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions-dependencies

Conversation

@renovate

@renovate renovate Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence Adoption Passing
actions/checkout v7.0.0v7.0.1 age confidence adoption passing
actions/labeler v6.1.0v6.2.0 age confidence adoption passing
actions/setup-node v6.4.0v6.5.0 age confidence adoption passing
actions/stale v10.3.0v10.4.0 age confidence adoption passing
deno (source) 2.9.02.9.4 age confidence adoption passing
denoland/setup-deno v2.0.4v2.0.5 age confidence adoption passing
dorny/paths-filter v4.0.1v4.0.2 age confidence adoption passing
github/codeql-action v4.36.2v4.37.4 age confidence adoption passing
ossf/scorecard-action v2.4.3v2.4.4 age confidence adoption passing
step-security/harden-runner v2.19.4v2.20.0 age confidence adoption passing

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

actions/labeler (actions/labeler)

v6.2.0

Compare Source

What's Changed

Bug Fix
Dependency Updates

Full Changelog: actions/labeler@v6.1.0...v6.2.0

actions/setup-node (actions/setup-node)

v6.5.0

Compare Source

What's Changed

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

actions/stale (actions/stale)

v10.4.0

Compare Source

What's Changed

Bug Fix
Dependency Updates
  • Bump undici to 6.27.0 via override, clean up stale license files, and version to 10.4.0. by @​dependabot in #​1342

New Contributors

Full Changelog: actions/stale@v10.3.0...v10.4.0

denoland/deno (deno)

v2.9.4

Compare Source

  • feat(desktop): enable --hmr for React Router (#​35900)
  • feat(ext/node): add a byteLength/length parameter to
    Buffer.indexOf/lastIndexOf/includes (#​35872)
  • feat(ext/node): support raw chacha20 cipher in crypto.createCipheriv (#​36016)
  • feat: upgrade V8 to 150.2.0 (#​36098)
  • fix(add): support --minimum-dependency-age flag in deno add/remove (#​36099)
  • fix(cache): store Web Cache under origin data (#​36145)
  • fix(canvas): require FFI permission for native window handles (#​36080)
  • fix(clean): reject symlinked node_modules cleanup roots (#​36190)
  • fix(compile): bump libsui to 0.16.4 to fix Windows resource SizeOfImage
    (#​36242)
  • fix(core): allow dynamic imports during cached module evaluation (#​36258)
  • fix(core): bound error graph conversion (#​36070)
  • fix(core): enforce JSON requests in FsModuleLoader (#​36137)
  • fix(core): handle malformed error constructors (#​36071)
  • fix(core): stop rejected dynamic imports before loading (#​36136)
  • fix(desktop): make BrowserWindow bindings typeable (#​35907)
  • fix(desktop): preserve binding wrappers after lazy op upgrade (#​36065)
  • fix(desktop): strip runtime extension from app name (#​36060)
  • fix(ext/napi): cancel async sends after close (#​36077)
  • fix(ext/napi): scope callback info per invocation (#​36076)
  • fix(ext/node): apply backpressure to http2 stream writes (#​36044)
  • fix(ext/node): don't leave 0-byte .heapsnapshot files near the heap limit
    (#​36113)
  • fix(ext/node): implement worker_threads.locks via Web Locks (#​35963)
  • fix(ext/node): node:sqlite backup() and deserialize() argument validation
    (#​36127)
  • fix(ext/node): retry DNS query when its per-attempt timeout fires (#​35955)
  • fix(ext/node): stop http2 file reads on stream close (#​36061)
  • fix(ext/web): handle failed webtransport datagram setup (#​36067)
  • fix(ext/webidl): implement async_sequence for ReadableStream.from (#​35976)
  • fix(fetch): bound multipart part headers (#​36096)
  • fix(fmt): keep embedded CSS custom property indentation stable (#​35949)
  • fix(fs): require sys permission for umask (#​36222)
  • fix(http): preserve trust proxy environment setting (#​36073)
  • fix(init): validate temporary node_modules parent (#​36142)
  • fix(jupyter): report codemirror_mode as a string (#​36241)
  • fix(loader): reject non-JSON modules for JSON imports (#​36135)
  • fix(napi): synchronize external string finalizers (#​36078)
  • fix(net): clean up cancellation resources on early errors (#​36229)
  • fix(net): limit WebTransport handshake frame buffering (#​36068)
  • fix(node_http2): clean up destroyed sessions (#​36043)
  • fix(node_resolver): handle CJS filesystem path edge cases (#​36112)
  • fix(node_stream): handle Web Stream adapter errors (#​36193)
  • fix(npm): avoid following lock poll symlinks (#​36192)
  • fix(npm): download tarballs from the configured registry instead of
    registry.npmjs.org (#​36187)
  • fix(npm): reject symlinked package materialization dirs (#​36191)
  • fix(outdated): keep type-only dependencies in the lockfile (#​36140)
  • fix(pack): support file paths longer than the tar name field (#​36105)
  • fix(permissions): escape bidi controls in prompts (#​36195)
  • fix(process): avoid collisions in Windows stdio pipe names (#​36081)
  • fix(publish): constrain generated source rewrites (#​36109)
  • fix(release): insert into versions.json in semver order (#​36097)
  • fix(rt): isolate extracted native addons (#​36144)
  • fix(runtime): bridge console to the inspector regardless of --inspect flag
    (#​35795)
  • fix(runtime): give worker isolate threads the stack size we report (#​36114)
  • fix(test): escape control characters in test names (#​36196)
  • fix(tests): make npm test registry tolerate a bad advisories request body
    (#​36138)
  • fix(tls): resolve sni requests concurrently (#​36062)
  • fix(update): don't downgrade lockfile when npm cache is stale (#​35904)
  • fix(webtransport): avoid url parse panic (#​36066)
  • fix(webtransport): validate certificate dates (#​36069)
  • fix(x): honor --minimum-dependency-age and deno.json minimumDependencyAge
    (#​36025)
  • fix: discover config file for jsr: entrypoints (#​35838)
  • fix: handle UTF-16 diagnostic columns (#​36028)
  • perf(core): avoid duplicating lazy ESM snapshot sources (#​36262)
  • perf(snapshot): mangle internal source identifiers (#​36263)
  • perf: compress bundled AppImage runtimes (#​36261)
  • perf: use FxHash for hot internal hash maps (#​36100)

v2.9.3

Compare Source

  • feat(cli): deno add --no-save and --save-optional (#​36039)
  • feat(cli): add --min-dep-age alias (#​35914)
  • feat(compile): support aarch64-pc-windows-msvc target (#​36004)
  • feat(ext/fetch): add http2MaxHeaderListSize option to
    Deno.createHttpClient (#​33194)
  • fix(bundle): preserve raw imports in watch mode (#​36040)
  • fix(canvas): don't hold SurfaceData mut borrow over window resize (#​35993)
  • fix(config): reject out-of-range minimum dependency ages (#​36051)
  • fix(core): block user ext imports after resolution (#​36012)
  • fix(core): deactivate idle TTY write handles (#​35886)
  • fix(core): restrict extension loaders to internal modules (#​36013)
  • fix(core): root slow op string coercions (#​36018)
  • fix(desktop): don't let op_desktop_send_error_report target caller-supplied
    URLs (#​35940)
  • fix(ext/http): don't panic recycling cancelled record on native response
    (#​36053)
  • fix(ext/napi): don't free threadsafe function on abort while refs remain
    (#​36032)
  • fix(ext/napi): don't resurrect a released threadsafe function in acquire
    (#​36054)
  • fix(ext/node): add deprecation warning for Duplex.toWeb({ type }) DEP0201
    (#​35972)
  • fix(ext/node): guard sqlite deserialize during callbacks (#​36023)
  • fix(ext/node): handle UTF-16 assert source positions (#​36029)
  • fix(ext/node): handle sqlite conversion failures (#​36024)
  • fix(ext/node): respect base64 buffer ranges (#​36030)
  • fix(ext/process): don't double-close extra stdio pipe handles on Windows
    (#​36005)
  • fix(lsp): respect lint rule exclusion for no-slow-types diagnostics (#​35924)
  • fix(node): stop active read on stream close to avoid leaking Socket/TCPWrap
    (#​35898)
  • fix(node_http2): keep header validation enabled (#​36042)
  • fix(node_http2): validate serialized headers (#​36041)
  • fix(npm): don't fetch registry info for deprecated packages under
    --cached-only (#​35903)
  • fix(npm): normalize path in BYONM read permission check (#​35882)
  • fix(pm): hint about minimumDependencyAge when no version is old enough
    (#​35890)
  • fix(release): only strip Mach-O signature for x86_64-apple-darwin (#​35902)
  • fix(release): strip Mach-O signature before patchver on apple targets (#​35897)
  • fix(runtime): guard usage op output buffers (#​36020)
  • fix(serde_v8): handle deserialization exceptions (#​36021)
  • fix(web): guard encodeInto fallback result buffer (#​36019)
  • fix(web): support Event subclasses with readonly toStringTag (#​35920)
  • fix(worker): remove imported ops during bootstrap (#​36014)
  • fix: don't print duplicate parse diagnostics (#​35933)
  • perf(ext/crypto): batch randomUUID generation (#​35953)
  • perf(ext/fetch): remove quadratic line buffering in EventSource (#​35881)
  • perf(ext/node): cache compiled glob matchers + bump bundled minimatch to
    10.2.5 (#​35873)
  • perf(ext/node): fast path fs cp (#​35856)
  • perf(ext/node): right-size small socket reads instead of pinning the 64KB slab
    (#​35779)
  • perf(ext/node): speed up sqlite.StatementSync.all() and run() (#​35863)
  • perf(ext/web): avoid copy-back in op_base64_atob large path (#​35862)

v2.9.2

Compare Source

  • feat(desktop): autodetect React Router framework (#​35557)
  • feat(desktop): enable --hmr for Vite and Nuxt (#​35851)
  • feat(desktop): run HMR by framework dev server (#​35722)
  • feat(desktop): window opacity and transparency APIs (#​35646)
  • feat(desktop): wire --exclude-unused-npm through to compile (#​35740)
  • feat(ext/node): implement v8.setHeapSnapshotNearHeapLimit (#​35694)
  • feat(ext/telemetry): honor OTEL_ATTRIBUTE_VALUE_LENGTH_LIMIT (#​35068)
  • feat(inspector): start inspector server on SIGUSR1 (#​35738)
  • feat(node): implement getTestContext() in node:test (#​35678)
  • feat: support wildcard patterns in minimumDependencyAge.exclude (#​35746)
  • fix(check): don't interleave errors with "Check" lines in a workspace (#​35687)
  • fix(compile): bump libsui to 0.16.1 to survive eu-strip in flatpak (#​35699)
  • fix(compile): bump libsui to 0.16.3 to fix segfault under gVisor/Cloud Run
    (#​35701)
  • fix(core): don't drain microtasks in mod_evaluate_sync mid-evaluation (#​35707)
  • fix(coverage): count a branch-junction line as covered when either arm runs
    (#​35858)
  • fix(coverage): don't count V8 block-boundary gaps as branches (#​35767)
  • fix(coverage): don't let a trailing comment change a line's hit count (#​35741)
  • fix(deploy): disable config discovery and refresh the cached CLI version
    (#​35754)
  • fix(desktop): attribute bind calls to the registering window id (#​35654)
  • fix(desktop): honor desktop.backend from deno.json (#​35815
  • fix(desktop): pin @​std/http in generated Vite SPA entrypoint + add hermetic
    compile test (#​35676)
  • fix(desktop): rename launcher to so it self-loads the runtime (#​35709)
  • fix(desktop): run framework build step before bundling output (#​35603)
  • fix(desktop): surface compiled-app startup errors instead of exiting silently
    (#​35567)
  • fix(dprint): exclude tools/lzld submodule (#​35778)
  • fix(ext): throw DataCloneError when posting non-serializable values (#​35604)
  • fix(ext/cache): implement Cache.keys() (#​35455)
  • fix(ext/fetch): reject transport failures with Node's "fetch failed" shape
    (#​35618)
  • fix(ext/http): error non-Uint8Array response streams (#​35783)
  • fix(ext/http): honor explicit content-length header on HEAD responses (#​35728)
  • fix(ext/http): point legacy abort warning at docs.deno.com/go link (#​35713)
  • fix(ext/napi): add uv_cond_* polyfills for native addons (#​35536)
  • fix(ext/net): abort pending Deno.connect during DNS resolution (#​35729)
  • fix(ext/node): allow adopting inherited extra stdio TCP fds (#​35805)
  • fix(ext/node): don't panic when main module path has invalid percent-encoding
    (#​35534)
  • fix(ext/node): don't schedule a pause in inspector.waitForDebugger() (#​35796)
  • fix(ext/node): flush StringDecoder in cipher final() for stream ciphers
    (#​35800)
  • fix(ext/node): mark TLSWrap dead on teardown before tls_conn check (#​35706)
  • fix(ext/node): report all active resources from process.getActiveResourcesInfo
    (#​35532)
  • fix(ext/node): require --allow-net=unix for node:net unix sockets (#​35835)
  • fix(ext/node): support fd 3 pipes in spawned Deno children (#​34133)
  • fix(ext/signals): unregister handler when SignalStream is dropped (#​35832)
  • fix(ext/web): resolve pending BYOB read when teeing a byte stream that closes
    (#​35828)
  • fix(fmt): format Astro inline scripts as TypeScript (#​35852)
  • fix(fs): support pre-1970 (negative) timestamps in FsStat (#​35517)
  • fix(inspector): close WebSocket connections when the runtime is torn down
    (#​35791)
  • fix(install): don't panic on jsr specifier with a tag like @​latest (#​35605)
  • fix(install): don't write through hardlinks when copying package files
    (#​35735)
  • fix(install): make setup cache packages hash deterministic (#​35825)
  • fix(install): resolve lifecycle script dependency bins against the hoisted
    layout (#​35762)
  • fix(install): support uninstalling multiple global packages (#​29352)
  • fix(lint): don't error on non-analyzable package exports like CSS files
    (#​35732)
  • fix(lint): include config file in workspace member invalid version error
    (#​35759)
  • fix(lsp): fix CPU busy loop by creating tokio runtime before JsRuntime in TSC
    thread (#​35595)
  • fix(node/fs): implement followSymlinks option for fs.glob() (#​35524)
  • fix(npm): don't re-fetch packuments on every run when registry has no time
    data (#​35834)
  • fix(npm): don't retain full npm exports value + fix --watch memory leak
    (#​35677)
  • fix(npm): widen node_modules lock staleness margin to avoid false preemption
    (#​35806)
  • fix(permissions): split comma-separated paths in --ignore-read (#​35661)
  • fix(test): run Node-API finalizers at test worker shutdown (#​35695)
  • fix(watch): accept watch paths in fmt/lint/bench --watch (#​35720)
  • fix(watch): execute preload modules under --watch (#​35792)
  • fix(watch): terminate on Ctrl+C while blocked in synchronous code (#​35826)
  • fix: enable rusqlite "fallible_uint" feature in workspace deps (#​35681)
  • perf(config): literal-suffix reject and prune irrelevant globs per base
    (#​35688)
  • perf(core): defer residual lazy source registration (#​35731)
  • perf(ext/fetch): stream wasm bytes to the compiler from Rust (#​35704)
  • perf(ext/node): remove per-chunk copying on TLSWrap data paths (#​35705)
  • perf(ext/node): zero-copy async Buffer writes on the stream_wrap path (#​35780)
  • perf(ext/web): identity pipeThrough writable bypass (#​35799)
  • perf(ext/web): persistent pump for the generic pipeTo loop (#​35813)
  • perf(ext/web): pump readableStreamCollectIntoUint8Array with a persistent read
    request (#​35790)
  • perf(ext/web): reduce per-chunk allocations on stream read and tee paths
    (#​35786)
  • perf(ext/web): reduce per-chunk overhead in Web Streams (#​35773)
  • perf(ext/web): run synchronous pull completion without a microtask hop
    (#​35788)
  • perf(ext/web): shared underlying-source algorithms, hoist resource-bridge read
    request (#​35810)
  • perf(ext/web): sync fast path for ReadableStream async iterator next()
    (#​35842)
  • perf(ext/web): synchronous transform fast path for TransformStream (#​35844)
  • perf(npm): index packuments with SIMD JSON scanner (#​35698)
  • perf(streams): offload resource-backed pipeTo to Rust via op_pipe (#​35689)
  • perf(workers): optimize message passing (#​35110)
  • perf(workers): return raw buffer from receive ops for no-transferable messages
    (#​35756)
  • perf: use V8 native queueMicrotask instead of op (#​35787)

v2.9.1

Compare Source

  • feat(check): add --desktop flag to type-check for deno desktop (#​35644)
  • feat(desktop): register deep-link URL schemes at bundle time (#​35466)
  • feat: update laufey to 0.5.0 (#​35663)
  • fix(bundle): emit CSSStyleSheet for CSS raw imports (#​35598)
  • fix(cache): skip checksums for cached 404 entries (#​35526)
  • fix(config): don't strip workspace-member includes from deploy config (#​34788)
  • fix(core): apply deferred fast-call op upgrade to the captured bootstrap clone
    (#​35630)
  • fix(core): prevent shared-buffer timer expiry race from losing timers (#​35312)
  • fix(desktop): default window title to app name instead of laufey_webview
    (#​35541)
  • fix(desktop): detect SvelteKit adapter-node and error on unsupported adapters
    (#​35533)
  • fix(desktop): discover deno.json in the project dir for deno desktop .
    (#​35660)
  • fix(desktop): don't delete user directories that collide with app name
    (#​35513)
  • fix(desktop): repair webview and raw backends on Windows (laufey v0.4.1)
    (#​35566)
  • fix(desktop): resolve launcher symlink so .deb/.rpm apps find the backend
    (#​35632)
  • fix(desktop): set LAUFEY_RUNTIME_PATH in Linux app launcher (#​35580)
  • fix(desktop): show macOS tray icon in bundled .app launched via Finder
    (#​35626)
  • fix(desktop): use zstd for appimage squashfs (#​35506)
  • fix(doc): strip blockquote > prefixes from JSDoc code blocks (#​34866)
  • fix(ext/fetch): include path and reason when fetching a file:// URL fails
    (#​35606)
  • fix(ext/node): check permissions when binding node:net unix sockets (#​35564)
  • fix(ext/node): export report as named export from node:process (#​35400)
  • fix(ext/node): mock.reset() should also reset MockTimers (#​35588)
  • fix(ext/node): pass Deno subcommands through child_process spawn (#​35599)
  • fix(ext/node): send TLS close_notify on JS stream-backed socket shutdown
    (#​35582)
  • fix(ext/node_sqlite): keep attach limit capped under scoped permissions
    (#​35232)
  • fix(ext/web): make URL and URLSearchParams non-serializable (#​35423)
  • fix(fmt): stable formatting of multi-line html/svg tagged templates (#​35540)
  • fix(inspector): support Chrome worker debugging (#​35629)
  • fix(install): pin pre-release npm versions added via dist-tag (#​35586)
  • fix(jupyter): register stdin peer only after ZMTP handshake completes (#​35585)
  • fix(lib): add PerformanceObserver and PerformanceObserverEntryList types
    (#​35640)
  • fix(libs/http): add missing write_flushed in
    poll_start_fixed_response_with (#​35649)
  • fix(lsp): watch .wasm files for changes (#​35560)
  • fix(node): load graph-backed TypeScript modules synchronously (#​35527)
  • fix(npm): decode percent-encoded subpath of npm specifiers (#​35505)
  • fix(npm): fall back for age-filtered npm dist-tags (#​35561)
  • fix(npm): normalize bin names with path separators (#​35555)
  • fix(npm): realpath npm bin main module (#​35554)
  • fix(npm): show scoped-registry auth hint on tarball 404 (#​35514)
  • fix(npm): use case-insensitive match for trust-policy-exclude (#​35520)
  • fix(rt_desktop): reveal initial window on first paint (startup black flash)
    (#​35620)
  • fix: correct property name for JSX new line configuration in schema file
    (#​35565)
  • fix: resolve LAUFEY_VERSION from crate-local Cargo.lock during publish
    (#​35507)
  • fix: show clear error when V8 fails to create worker threads (#​32856)
  • perf(core/webidl): check next method outside of iterator loop (#​35480)
  • perf(ext/fetch): fast-path Response reconstruction (#​35495)
  • perf(ext/http): coalesce chunked response writes into a single write (#​35523)
denoland/setup-deno (denoland/setup-deno)

v2.0.5

Compare Source

What's Changed

New Contributors

Full Changelog: denoland/setup-deno@v2.0.0...v2.0.5

dorny/paths-filter (dorny/paths-filter)

v4.0.2

Compare Source

github/codeql-action (github/codeql-action)

v4.37.4

Compare Source

v4.37.3

Compare Source

No user facing changes.

v4.37.2

Compare Source

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #​4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #​4007

v4.37.1

Compare Source

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #​3956
  • Update default CodeQL bundle version to 2.26.1. #​4019

v4.37.0

Compare Source

  • Update default CodeQL bundle version to 2.26.0. #​3995
  • In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@​ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #​3973

v4.36.3

Compare Source

No user facing changes.

ossf/scorecard-action (ossf/scorecard-action)

v2.4.4

Compare Source

What's Changed

This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the Scorecard v5.4.0 release notes and the Scorecard v5.5.0 release notes.

Full Changelog: ossf/scorecard-action@v2.4.3...v2.4.4

step-security/harden-runner (step-security/harden-runner)

v2.20.0

Compare Source

What's Changed
  • Support for block policy for MacOS and Windows GitHub-hosted runners
  • Support for Bitrise MacOS GitHub Actions runners
  • HTTPS monitoring support for Bun for Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.19.4...v2.20.0


Configuration

📅 Schedule: (in timezone Asia/Kolkata)

  • Branch creation
    • "on the first day of the month"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot enabled auto-merge (squash) July 31, 2026 22:16
@renovate renovate Bot added the renovate label Jul 31, 2026
@vercel

vercel Bot commented Jul 31, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated (UTC)
monoline-ui Ignored Ignored Jul 31, 2026 10:16pm

@chitrank-actions chitrank-actions Bot added area/ci CI/CD workflows and actions configuration area/security Security policies and scanner configurations labels Jul 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/ci CI/CD workflows and actions configuration area/security Security policies and scanner configurations dependencies renovate

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant