chore(deps): update wearerequired/lint-action to v3

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
wearerequired/lint-action	action	major	v2.3.0 → v3.0.2

---

Release Notes

wearerequired/lint-action (wearerequired/lint-action)

v3.0.2

Compare Source

This patch release fixes an auto-fix crash and refreshes bundled and development dependencies.

🐛 Fixes

• auto_fix no longer crashes when tracked files are only stat-dirty. A tracked file rewritten with identical content — a lockfile touched by a dependency install step, or a formatter that rewrites files without changing them — was reported as changed while git commit -am had nothing to commit, which crashed the action. The Git index is now refreshed before change detection. (#​1019, fixes #​140)

🔒 Dependencies

• Bumped vulnerable transitive dependencies to patched versions within their existing ranges — minimatch (5.1.9 in the shipped bundle via glob), brace-expansion, js-yaml, flatted, picomatch, and braces/minimatch/picomatch/flatted in the test fixtures. Clears all open Dependabot alerts.

  These are ReDoS/parsing advisories in glob/cache internals and are not reachable with attacker-controlled input in the action (the only shipped glob call uses an owner-configured, fixed-shape pattern) — dependency hygiene, not a fix for an exploitable issue. (#​1017)

Full changelog: wearerequired/lint-action@v3.0.1...v3.0.2

v3.0.1

Compare Source

This patch release fixes a stylelint regression from the stylelint 16 support added in v3.0.0.

🐛 Fixes

• stylelint no longer fails on clean CSS. stylelint 16 prints its JSON report to stderr and exits with 0 when there are no issues. The runner only captured stderr on a non-zero exit, so a clean project produced an empty report and the action failed with Error parsing stylelint JSON output. stderr is now captured regardless of exit code, and a regression test covers the exit-0 path. (#​1016)

Full changelog: wearerequired/lint-action@v3.0.0...v3.0.1

v3.0.0

Compare Source

This is a major release. lint-action now runs on Node.js 24, adds several new linters, and ships a security fix along with many robustness improvements accumulated since v2.3.0.

⚠️ Breaking changes

• Runs on Node.js 24. GitHub-hosted runners handle this automatically; self-hosted runners must be updated to Actions Runner ≥ 2.327.1. (#​995)
• ERB Lint now requires erb_lint ≥ 0.7.0. The action calls the erb_lint executable instead of the deprecated erblint shim (which is broken on Windows). (#​997, #​1001)

✨ New linters

• Ruff — Python (#​1013)
• Standard Ruby (standardrb) — Ruby (#​1008)
• isort — Python (#​1006)
• staticcheck — Go (#​1004)
• clippy — Rust (#​586)
• rustfmt — Rust (#​585)

🔒 Security

• Fixed a command-injection vulnerability: an attacker-controlled pull request branch name (from a fork) was interpolated unquoted into shell commands. All interpolated values are now shell-escaped. (#​1002)

🐛 Fixes & improvements

• stylelint 16 is now supported (it prints its report to stderr). (#​993)
• Annotations now work with [linter]_dir, and dotnet-format annotations show up on Windows — annotation paths are made repo-root-relative and use forward slashes. (#​1012, fixes #​94 and #​608)
• More than 50 annotations are sent to the Checks API in batches instead of dropping everything after the first 50. (#​1005, fixes #​749)
• Prettier no longer fails with an opaque 422 error when it cannot parse a file; the parse error is surfaced as an annotation. (#​1003, fixes #​718)
• Fixed checking out the pull request branch when it is already checked out, and made the fetch/push robust. (#​1000, fixes #​193)
• The swift-format (official) linter is tested again — now on macOS, Linux and Windows. (#​1009, #​1010, #​1011, fixes #​213)

🗑️ Deprecations

• golint is deprecated (its upstream is frozen and archived) — use staticcheck instead. (#​1004)

🧰 Under the hood

• Toolchain and workflow modernization: Node 24, Python 3.14, Ruby 4.0, Go stable, current linter and GitHub Actions versions, and refreshed test fixtures. (#​996, #​997, #​998)

Full changelog: wearerequired/lint-action@v2.3.0...v3.0.0

v3

Compare Source

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • Between 12:00 PM and 12:59 PM (* 12 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.