chore(deps): update all-ci-updates

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/attest	action	minor	v4.1.0 → v4.2.1	v4.2.2
actions/checkout	action	minor	v6.0.3 → v6.1.0
actions/setup-node	action	minor	v6.4.0 → v6.5.0
actions/stale	action	minor	v10.3.0 → v10.4.0
docker/build-push-action	action	minor	v7.2.0 → v7.3.0
docker/login-action	action	minor	v4.2.0 → v4.6.0
softprops/action-gh-release	action	patch	v3.0.0 → v3.0.2
zgosalvez/github-actions-ensure-sha-pinned-actions	action	patch	v5.0.4 → v5.0.6	v5.0.7

---

Release Notes

actions/attest (actions/attest)

v4.2.1

Compare Source

What's Changed

• Bump tar from 7.5.17 to 7.5.21 by @​dependabot[bot] in #​459
• fix: strip OCI image tag when pushing attestation to registry by @​bdehamer in #​464

Full Changelog: actions/attest@v4.2.0...v4.2.1

v4.2.0

Compare Source

What's Changed

• fix: split checksums on any line ending so LF files parse on Windows by @​bdehamer in #​443
• Bump @​actions/glob from 0.6.1 to 0.7.0 in the npm-production group across 1 directory by @​dependabot[bot] in #​435
• Bump csv-parse from 6.2.1 to 7.0.1 by @​dependabot[bot] in #​437
• Read subjects from GITHUB_ARTIFACTS_LIST by @​bdehamer in #​447
• Support SHA-2 subject digests by @​bdehamer in #​446

Full Changelog: actions/attest@v4.1.1...v4.2.0

v4.1.1

Compare Source

What's Changed

• Bump tar from 7.5.9 to 7.5.10 by @​dependabot[bot] in #​371
• Bump tar from 7.5.10 to 7.5.11 by @​dependabot[bot] in #​375
• Bump the npm-production group across 1 directory with 2 updates by @​dependabot[bot] in #​404
• Bump minimatch by @​dependabot[bot] in #​399
• Bump brace-expansion from 1.1.12 to 1.1.14 by @​dependabot[bot] in #​397
• Bump undici from 6.23.0 to 6.24.1 by @​dependabot[bot] in #​381
• Bump ip-address from 10.1.0 to 10.2.0 by @​dependabot[bot] in #​411
• Bump undici from 7.25.0 to 8.2.0 by @​dependabot[bot] in #​409
• Bump tar from 7.5.11 to 7.5.17 by @​dependabot[bot] in #​429
• Bump csv-parse from 5.6.0 to 6.2.1 by @​dependabot[bot] in #​414
• Bump @​sigstore/oci from 0.6.1 to 0.7.1 by @​bdehamer in #​432

Full Changelog: actions/attest@v4.1.0...v4.1.1

actions/checkout (actions/checkout)

v6.1.0

Compare Source

actions/setup-node (actions/setup-node)

v6.5.0

Compare Source

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in #​1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

actions/stale (actions/stale)

v10.4.0

Compare Source

What's Changed

Bug Fix

• Fixed only-issue-types validation by @​trueberryless in #​1338

Dependency Updates

• Bump undici to 6.27.0 via override, clean up stale license files, and version to 10.4.0. by @​dependabot in #​1342

New Contributors

• @​trueberryless made their first contribution in #​1338

Full Changelog: actions/stale@v10.3.0...v10.4.0

docker/build-push-action (docker/build-push-action)

v7.3.0

Compare Source

docker/login-action (docker/login-action)

v4.6.0

Compare Source

v4.5.2

Compare Source

v4.5.1

Compare Source

v4.5.0

Compare Source

v4.4.0

Compare Source

v4.3.0

Compare Source

• Preserve names in esbuild bundle by @​crazy-max in #​1022
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1076.0 #​999 #​1030
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in #​1004 #​1027
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in #​1023
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in #​1029
• Bump http-proxy-agent and https-proxy-agent to 9.1.0 in #​1017
• Bump js-yaml from 4.1.1 to 5.2.0 in #​1028
• Bump sigstore from 4.1.0 to 4.1.1 in #​1031
• Bump tmp from 0.2.5 to 0.2.7 in #​1002
• Bump undici from 6.24.1 to 6.27.0 in #​1020
• Bump vite from 7.3.3 to 7.3.6 in #​1019

Full Changelog: docker/login-action@v4.2.0...v4.3.0

softprops/action-gh-release (softprops/action-gh-release)

v3.0.2

Compare Source

3.0.2 is a patch release focused on release reliability and compatibility. It
reuses existing draft releases when publishing prereleases, supports replacing
release assets on Gitea, hardens streamed asset uploads, and provides clearer
release-creation diagnostics. It also includes TypeScript, coverage, and tooling
maintenance merged since 3.0.1.

This release fixes #​795, #​438, and #​803. The upload transport hardening covers the
historical failure reported in #​790, although current hosted Node 24 runners did
not reproduce it naturally. The diagnostics work is related to #​786 and does not
claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

• feat: improve release error reporting and test coverage by @​chenrui333 in #​813

Bug fixes 🐛

• fix: publish existing draft releases as prereleases by @​godfengliang in #​801
• fix: upload small checksum assets reliably by @​chenrui333 in #​815
• fix: replace existing release assets on Gitea by @​chenrui333 in #​816
• fix: clarify release creation 404 errors by @​chenrui333 in #​817

Other Changes 🔄

• chore(deps): upgrade TypeScript to 7 by @​chenrui333 in #​812
• chore(deps): remove unused TypeScript tooling by @​chenrui333 in #​814
• dependency, Node 24 pin, and CI maintenance merged since 3.0.1

v3.0.1

Compare Source

3.0.1

• maintenance release with updated dependencies

zgosalvez/github-actions-ensure-sha-pinned-actions (zgosalvez/github-actions-ensure-sha-pinned-actions)

v5.0.6

Compare Source

What's Changed

• Bump eslint from 10.3.0 to 10.8.0 by @​dependabot[bot] in #​329
• Bump yaml from 2.8.4 to 2.9.0 by @​dependabot[bot] in #​326
• Bump zgosalvez/github-actions-get-action-runs-using-version from 3.0.1 to 3.0.2 by @​dependabot[bot] in #​324
• Bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 by @​dependabot[bot] in #​323
• Bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in #​322
• Bump actions/cache from 5.0.5 to 6.1.0 by @​dependabot[bot] in #​321
• Bump @​vercel/ncc from 0.38.4 to 0.44.1 by @​dependabot[bot] in #​325
• Hotfix/dp61 by @​zgosalvez in #​330
• Fix invocations by @​zgosalvez in #​331
• Potential fix for code scanning alert no. 17: Shell command built from environment values by @​zgosalvez in #​332
• Potential fix by @​zgosalvez in #​333
• Another potential fix by @​zgosalvez in #​334

Full Changelog: zgosalvez/github-actions-ensure-sha-pinned-actions@v5...v5.0.6

v5.0.5

Compare Source

What's Changed

• Bump undici from 6.24.1 to 6.27.0 by @​dependabot[bot] in #​317
• Bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in #​316
• Bump jest from 30.3.0 to 30.4.2 by @​dependabot[bot] in #​315
• Bump eslint from 10.1.0 to 10.3.0 by @​dependabot[bot] in #​314
• Bump yaml from 2.8.3 to 2.8.4 by @​dependabot[bot] in #​313
• Bump actions/setup-node from 6.2.0 to 6.4.0 by @​dependabot[bot] in #​312
• Bump actions/cache from 5.0.3 to 5.0.5 by @​dependabot[bot] in #​311
• Bump @​actions/core from 3.0.0 to 3.0.1 by @​dependabot[bot] in #​310
• Bump @​actions/glob from 0.6.1 to 0.7.0 by @​dependabot[bot] in #​309
• Bump zgosalvez/github-actions-get-action-runs-using-version from 2.0.25 to 3.0.1 by @​dependabot[bot] in #​305
• Fix dependabot security alert 59 by @​zgosalvez in #​318
• Hotfix/security60 by @​zgosalvez in #​319
• Fix js-yaml dependency issue by @​zgosalvez in #​320

Full Changelog: zgosalvez/github-actions-ensure-sha-pinned-actions@v5...v5.0.5

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Copilot]

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.