chore(deps): update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
docker/login-action	action	minor	v4.4.0 → v4.6.0
github/codeql-action	action	patch	v4.37.3 → v4.37.4	v4.37.5
immich-app/devtools	action	patch	use-mise-action-v3.2.0 → use-mise-action-v3.2.1
oasdiff/oasdiff-action	action	patch	v0.1.8 → v0.1.10	v0.1.11

---

Release Notes

docker/login-action (docker/login-action)

v4.6.0

Compare Source

v4.5.2

Compare Source

v4.5.1

Compare Source

v4.5.0

Compare Source

github/codeql-action (github/codeql-action)

v4.37.4

Compare Source

oasdiff/oasdiff-action (oasdiff/oasdiff-action)

v0.1.10

Compare Source

Security release. Every action now runs on oasdiff v1.26.1.

Highlights

Security fix: git revision parsed as a git option (GHSA-m3wq-w7x2-4q6m)

All six actions (breaking, changelog, diff, pr-comment, validate, verify) move their base image from tufin/oasdiff:v1.26.0 to tufin/oasdiff:v1.26.1, which fixes an option-injection issue on the git-revision load path.

oasdiff passed git revisions to git as operands with no end-of-options separator, so a revision beginning with - was parsed by git as an option rather than a revision. git show --output=<path> writes git's output to a chosen path (an arbitrary file overwrite running as the invoking user), and git fetch --upload-pack=<program> makes git execute a program.

oasdiff v1.26.1 fixes this in two layers: every git invocation now passes --end-of-options, and a revision beginning with - is rejected before git is invoked.

Who should upgrade: anyone pinned to an exact action version. If you pin @v0, you already have this, since v0 now points at this release.

Workflow authors: if you interpolate untrusted input into the base: or revision: inputs, upgrade. Workflows that pass literal refs or file paths were not affected.

Full Changelog: oasdiff/oasdiff-action@v0.1.9...v0.1.10

v0.1.9

Compare Source

What's Changed

Updates the bundled oasdiff to v1.26.0, which adds breaking-change and changelog detection for response header schema changes: type, format, and nullability. A response header going from string/date-time to integer, for example, is now reported where it was previously silent.

See the oasdiff v1.26.0 release notes for the full list.

Note: specs with response-header type, format, or nullability changes may surface new findings on your PRs, including new breaking-change errors. Adjust per-check with .oasdiff.yaml severity settings if needed.

• bump: oasdiff v1.26.0 by @​reuvenharrison in #​191

Full Changelog: oasdiff/oasdiff-action@v0.1.8...v0.1.9

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on tuesday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[immich-push-o-matic]

📱 Android release APK (universal) — 859ed87eefedd9a4da68512618ef8d769df80a7f

Download: https://github.com/immich-app/immich/actions/runs/30897064152/artifacts/8887702062

QR code

Installs as a separate app (applicationId app.alextran.immich.pr30543), so it coexists with the Play Store version and any other PR builds.