chore(deps): update support-deps

.github/actions/install-tools/action.yaml

@@ -14,4 +14,4 @@ runs:
     - run: "curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin"
       shell: bash
 
-    - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+    - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

.github/actions/mise/action.yaml

@@ -7,10 +7,10 @@ description: Install the repository-pinned development tools
 runs:
   using: composite
   steps:
-    - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
+    - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
       with:
         # renovate: datasource=github-releases depName=jdx/mise versioning=semver
-        version: 2026.8.2
+        version: 2026.8.14
         install: true
         cache: true
 
@@ -23,7 +23,7 @@ runs:
         echo "version=$(go env GOVERSION)" >> "$GITHUB_OUTPUT"
 
     - name: Cache Go dependencies and build artifacts
-      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: |
           ${{ steps.go-cache.outputs.mod }}

.github/workflows/scan-codeql.yaml

@@ -53,7 +53,7 @@ jobs:
         run: uds run build-cli-linux-amd
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         env:
           CODEQL_EXTRACTOR_GO_BUILD_TRACING: on
         with:
@@ -62,6 +62,6 @@ jobs:
 
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/scorecard.yaml

@@ -47,6 +47,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           sarif_file: results.sarif

.github/workflows/test.yaml

@@ -370,7 +370,7 @@ jobs:
         uses: ./.github/actions/setup-uds-e2e
 
       - name: Login to GHCR
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -408,7 +408,7 @@ jobs:
           create-cluster: "false"
 
       - name: Login to GHCR
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -444,7 +444,7 @@ jobs:
           create-cluster: "false"
 
       - name: Login to GHCR
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

mise.toml

@@ -3,7 +3,7 @@
 
 [tools]
 go = "1.27.0"
-hk = "1.54.0"
+hk = "1.56.1"
 jq = "1.8.2"
 golangci-lint = "2.13.1"
 "github:goreleaser/goreleaser" = "2.17.1"
@@ -13,7 +13,7 @@ node = "24.19.0"
 # renovate: datasource=github-tags depName=google/addlicense versioning=semver
 "aqua:google/addlicense" = "1.2.0"
 # renovate: datasource=github-tags depName=defenseunicorns/uds-cli versioning=semver
-"aqua:defenseunicorns/uds-cli" = "0.35.0"
+"aqua:defenseunicorns/uds-cli" = "0.36.0"
 
 [env]
 MISE_USE_VERSIONS_HOST_TRACK = "0"

renovate.json

@@ -69,6 +69,15 @@
       ],
       "datasourceTemplate": "docker",
       "versioningTemplate": "regex:^v?(?<major>\\d+)(\\.(?<minor>\\d+))?(\\.(?<patch>\\d+))?(-uds\\.(?<build>\\d+))?(-(?<compatibility>\\w+)?)?(.*?)?$"
+    },
+    {
+      "customType": "regex",
+      "description": "Matches inline Renovate comments for UDS Core version pins.",
+      "managerFilePatterns": ["/(^|/)(tests|docs|tasks|\\.github)/.*$/"],
+      "matchStrings": [
+        "// renovate: datasource=(?<datasource>docker|github-tags) depName=(?<depName>defenseunicorns/uds-core|ghcr\\.io/defenseunicorns/packages/uds/core)(?: extractVersion=(?<extractVersion>\\S+))? versioning=(?<versioning>\\S+)\\s+(?:version\\s+=|assert\\.Contains\\(t, bundleDefinition,)\\s+\"(?<currentValue>[^\"]+)\""
+      ],
+      "extractVersionTemplate": "{{#if extractVersion}}{{{extractVersion}}}{{/if}}"
     }
   ]
 }

tasks/lint.yaml

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
 
 includes:
-  - common: https://raw.githubusercontent.com/defenseunicorns/uds-common/v1.27.1/tasks/lint.yaml
+  - common: https://raw.githubusercontent.com/defenseunicorns/uds-common/v1.28.0/tasks/lint.yaml
 
 tasks:
   - name: license

testdata/legacy/packages/gitrepo/refs/deployment.yaml

@@ -17,6 +17,6 @@ spec:
     spec:
       containers:
         - name: nginx
-          image: docker.io/library/nginx:1.31.3
+          image: docker.io/library/nginx:1.31.4
           ports:
             - containerPort: 80

testdata/legacy/packages/gitrepo/zarf.yaml

@@ -28,4 +28,4 @@ components:
                 namespace: nginx
                 condition: available
     images:
-      - docker.io/library/nginx:1.31.3
+      - docker.io/library/nginx:1.31.4

testdata/legacy/packages/nginx-namespace-override/refs/deployment.yaml

@@ -17,6 +17,6 @@ spec:
     spec:
       containers:
         - name: nginx
-          image: nginx:1.31.3
+          image: nginx:1.31.4
           ports:
             - containerPort: 80

testdata/legacy/packages/nginx-namespace-override/zarf.yaml

@@ -15,4 +15,4 @@ components:
         files:
           - refs/deployment.yaml
     images:
-      - nginx:1.31.3
+      - nginx:1.31.4

testdata/legacy/packages/nginx/refs/deployment.yaml

@@ -17,6 +17,6 @@ spec:
     spec:
       containers:
       - name: nginx
-        image: nginx:1.31.3
+        image: nginx:1.31.4
         ports:
         - containerPort: 80

testdata/legacy/packages/nginx/refs/zarf.yaml

@@ -25,4 +25,4 @@ components:
                 namespace: nginx
                 condition: available
     images:
-      - nginx:1.31.3 # use shorthand for nginx!
+      - nginx:1.31.4 # use shorthand for nginx!

testdata/legacy/packages/nginx/zarf.yaml

@@ -24,4 +24,4 @@ components:
                 namespace: nginx
                 condition: available
     images:
-      - nginx:1.31.3 # use shorthand for nginx!
+      - nginx:1.31.4 # use shorthand for nginx!

tests/integration/cmd/bundle/create_integration_test.go

@@ -242,5 +242,6 @@ func TestCreate_UDSCoreStandardBundle(t *testing.T) {
 	for _, component := range []string{"istio-passthrough-gateway", "istio-egress-gateway", "envoy-gateway", "envoy-default-gateway"} {
 		assert.Contains(t, bundleDefinition, component, "standard should preserve upstream optional components")
 	}
-	assert.Contains(t, bundleDefinition, "1.9.0-upstream", "standard should target the released core package tag")
+	// renovate: datasource=docker depName=ghcr.io/defenseunicorns/packages/uds/core versioning=docker
+	assert.Contains(t, bundleDefinition, "1.11.1-upstream", "standard should target the released core package tag")
 }

tests/test_data/bundles/spec-compliant/bundle.uds.hcl

@@ -24,7 +24,7 @@ metadata {
 locals {
   repo    = "ghcr.io/defenseunicorns/packages/uds"
   // renovate: datasource=docker depName=ghcr.io/defenseunicorns/packages/uds/core versioning=docker
-  version = "1.9.0-upstream"
+  version = "1.11.1-upstream"
 
   pkgs = {
     base       = "core-base"

tests/test_data/bundles/uds-core/standard/bundle.uds.hcl

@@ -9,14 +9,14 @@ metadata {
   name        = "k3d-core-demo"
   description = "A UDS bundle for deploying the standard UDS Core package on a development cluster"
   // renovate: datasource=github-tags depName=defenseunicorns/uds-core extractVersion=^v?(?<version>.*)$ versioning=semver
-  version     = "1.9.0"
+  version     = "1.11.1"
 }
 
 locals {
   uds_repo      = "ghcr.io/defenseunicorns/packages/uds"
   k3d_repo      = "ghcr.io/defenseunicorns/packages"
   // renovate: datasource=docker depName=ghcr.io/defenseunicorns/packages/uds/core versioning=docker
-  core_version  = "1.9.0-upstream"
+  core_version  = "1.11.1-upstream"
   // renovate: datasource=docker depName=ghcr.io/defenseunicorns/packages/uds-k3d versioning=docker
   k3d_version   = "0.20.2-airgap"
   // renovate: datasource=docker depName=ghcr.io/zarf-dev/packages/init versioning=docker