chore(deps): update github actions

[oep-renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
actions/create-github-app-token	action	minor	v3.1.1 → v3.2.0
ghcr.io/renovatebot/renovate (source)		minor	43.160.2 → 43.207.4
github/codeql-action	action	minor	v4.35.4 → v4.36.0
renovatebot/renovate		minor	43.160.7 → 43.207.4
step-security/harden-runner	action	patch	v2.19.0 → v2.19.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/create-github-app-token (actions/create-github-app-token)

v3.2.0

Compare Source

Features

• add support for enterprise-level GitHub Apps (#​263) (952a2a7)
• support full repository names in repositories input (#​372) (85eb8dd)

Bug Fixes

• deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#​364) (43e5c34)
• validate private-key input (#​376) (f24bbd8)

renovatebot/renovate (ghcr.io/renovatebot/renovate)

v43.207.4

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v13.55.4 (main) (#​43720) (a65e279)

v43.207.3

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v13.55.2 (main) (#​43717) (c17741f)

v43.207.2

Compare Source

Bug Fixes

• util/http: remove workaround for onCancel (#​43713) (1f5acc0)

Miscellaneous Chores

• deps: update devcontainers/ci action to v0.3.1900000450 (main) (#​43714) (0d78978)

v43.207.1

Compare Source

Bug Fixes

• datasource/docker: avoid caching null digest results (#​43521) (8a7d6b9)

v43.207.0

Compare Source

Features

• presets: link to Octochangelog for updates to Renovate itself (#​43712) (87b4a04), closes #​41809

v43.206.1

Compare Source

Bug Fixes

• types: allow gitUrl in global config (#​43652) (80690bf)
• util/fingerprint: incrementally hash input to avoid V8 max string length (#​43605) (e4710c1)

Documentation

• development: npm deprecate old versions (#​43675) (036da65)
• presets: clarify local> usage (#​43679) (bc1850c)

Build System

• deps: update dependency node to v24.16.0 (main) (#​43660) (dd1e0c8)
• replace extract-zip with adm-zip (#​43709) (3afdb6f)

v43.206.0

Compare Source

Features

• data: automatic update of static data (#​43702) (15a73fb)

v43.205.3

Compare Source

Documentation

• update references to python to 250e5c9 (main) (#​43705) (d755b7a)

Tests

• git: increase timeout to 30s (#​43704) (6f9411c)

Build System

• deps: update aws-sdk-js-v3 monorepo to v3.1053.0 (main) (#​43706) (2bf5f3e)

v43.205.2

Compare Source

Build System

• deps: update dependency markdown-it to v14.2.0 (main) (#​43701) (af9be72)

v43.205.1

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v13.55.1 (main) (#​43694) (b69b637)

Miscellaneous Chores

• deps: update ghcr.io/containerbase/devcontainer docker tag to v14.10.21 (main) (#​43693) (4cb1785)
• migrate from zod/v3 to zod/v4 (#​43691) (15f4bd8)

v43.205.0

Compare Source

Features

• data: automatic update of static data (#​43559) (442bb9c)

Bug Fixes

• autoreplace: handle digest-only update without replaceString (#​42840) (2d0d32c)

Miscellaneous Chores

• deps: update containerbase/internal-tools action to v4.6.36 (main) (#​43690) (a9db3a3)

v43.204.1

Compare Source

Bug Fixes

• workers/repository: skip pending-version check when re-extracted dep lacks resolved version (#​43348) (0ab2acf), closes #​41629

Miscellaneous Chores

• deps: update dependency pipx to v1.13.0 (main) (#​43688) (0657330)

v43.204.0

Compare Source

Features

• presets: support fetching .jsonc files (#​43680) (0ccf832)

Documentation

• add a "deep dive" on environment variables (#​43243) (cbd174e)

v43.203.0

Compare Source

Features

• config: support explicit .jsonc file (#​43677) (6fb540d), closes #​40868 #​36141

Documentation

• config: reword repo configuration options header (#​43678) (7a2af53)

Miscellaneous Chores

• oxlint: enable unicorn plugin and prefer-node-protocol (#​43283) (392105b)

v43.202.1

Compare Source

Miscellaneous Chores

• deps: update dependency protobufjs@​8.0.1 to v8.4.2 (main) (#​43671) (27dd08d)

Build System

• deps: update dependency protobufjs to v8.4.2 (main) (#​43670) (ae1039a)

v43.202.0

Compare Source

Features

• deps: update ghcr.io/renovatebot/base-image docker tag to v13.55.0 (main) (#​43669) (f3ed6fb)

v43.201.3

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v13.54.2 (main) (#​43668) (05bd161)

v43.201.2

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v13.54.1 (main) (#​43667) (7b74cba)

Miscellaneous Chores

• deps: update dependency protobufjs@​8.0.1 to v8.4.1 (main) (#​43666) (0b6059d)

v43.201.1

Compare Source

Miscellaneous Chores

• deps: update dependency @​smithy/util-stream to v4.6.4 (main) (#​43664) (e8d3159)

Build System

• deps: update dependency protobufjs to v8.4.1 (main) (#​43663) (779866a)

v43.201.0

Compare Source

Features

• deps: update ghcr.io/renovatebot/base-image docker tag to v13.54.0 (main) (#​43662) (7929cc5)

Build System

• deps: update dependency semver to v7.8.1 (main) (#​43661) (4bc64c5)

v43.200.1

Compare Source

Bug Fixes

• deps): Revert "build(deps: update dependency node to v24.16.0 (main)" (#​43658) (249c3bf), closes #​43527

v43.200.0

Compare Source

Features

• deps: update ghcr.io/renovatebot/base-image docker tag to v13.53.0 (main) (#​43655) (675baee)

Miscellaneous Chores

• add config.ts to .gitignore (#​43654) (2136506)

Continuous Integration

• mise: add the PDM toolchain to Mise (#​43650) (bf6bfa8)

v43.199.0

Compare Source

Features

• monorepo: Add solid-design-system/solid repository (#​43649) (9ae005b)

Miscellaneous Chores

• clarify GHSA process is recommended (#​43644) (16f74f6)
• deps: update dependency vite to v8.0.14 (main) (#​43640) (edeb92e)

v43.198.0

Compare Source

Features

• monorepo: Add Tomcat monorepo (#​43602) (e0e1004)

Documentation

• docs: remove usage of prettier-ignore in site generation (#​43632) (3ecf715)

Continuous Integration

• normalize admonition indentation using mkdocs-admonition (#​43630) (e839b18)

v43.197.0

Compare Source

Features

• manager/sveltos: add Sveltos ClusterPromotion (#​43612) (f481a9f)

Bug Fixes

• config-migration: always reset migration info (#​43628) (c116326)
• lookup: try to find a release for changelog by newVersion if not found by newValue (#​38894) (950f9a4)
• versioning/maven: do not insert hyphens in right range boundaries with transition (#​43626) (86a9fe5)

Documentation

• dev: add code example of regex utility (#​43624) (fcadf4c)

Miscellaneous Chores

• deps: update vitest monorepo to v4.1.7 (main) (#​43619) (dba13db)

Continuous Integration

• add auto label for "please follow our PR template" (#​43622) (b3f533b)
• add auto label for "please sign the CLA" (#​43623) (ce782e3)
• mend-slack: correctly notify on new Discussions (#​43621) (ea01552)
• prettier: add prettier plugin for admonitions (#​43615) (9a27d7a)

v43.196.1

Compare Source

Bug Fixes

• maven: determine properly closed ranges (#​38892) (7829d94), closes #​38895

v43.196.0

Compare Source

Features

• deps: update ghcr.io/renovatebot/base-image docker tag to v13.52.0 (main) (#​43617) (07402e7)

Build System

• deps: update dependency lru-cache to v11.5.0 (main) (#​43616) (d5a5d12)

v43.195.13

Compare Source

Build System

• deps: update dependency @​yarnpkg/core to v4.8.0 (main) (#​43614) (2ef5e90)

v43.195.12

Compare Source

Build System

• deps: update dependency simple-git to v3.36.0 [security] (main) (#​43122) (24154eb), closes #​43268

v43.195.11

Compare Source

Build System

• deps: update dependency jsonata to v2.2.1 (main) (#​43599) (874c551)

v43.195.10

Compare Source

Bug Fixes

• manager/circleci: parse config files as YAML 1.1 (#​43551) (afd16f7)

v43.195.9

Compare Source

Documentation

• migrate all admonitions and lists to using 2-space indents (#​43607) (33e857e), closes #​43537
• minimum-release-age: clarify registry-controlled metadata required (#​43591) (66d7704)
• templates hyperlink not being rendered (#​43603) (1844916)
• usage/java: document existing Gradle verification-metadata.xml Support (#​43287) (c05f76b)

Miscellaneous Chores

• deps: update ghcr.io/containerbase/devcontainer docker tag to v14.10.19 (main) (#​43604) (c1f0a4d)
• renovate: group depName=node together (#​43596) (88d7436)

Build System

• deps: update dependency node to v24.16.0 (main) (#​43527) (c40927f)

Continuous Integration

• do not allow nested tenary operators (#​43600) (a1772c2)
• lint-staged: format JSON on changes (#​43597) (11239db)
• update-data: use GitHub Actions author for commits (#​43595) (ccd6943), closes #​39309

v43.195.8

Compare Source

Documentation

• use 2-space indentation for Markdown (#​43537) (4b0146a), closes #​39090

Miscellaneous Chores

• deps: update dessant/lock-threads action to v6.0.2 (main) (#​43554) (9e0ec17)

Build System

• deps: update dependency p-queue to v9.3.0 (main) (#​43556) (715cb7a)

v43.195.7

Compare Source

Bug Fixes

• manager/npm: allow dots in github dependency repo names (#​43493) (069ace8)

Documentation

• add "previously known as" to renamed options (#​43533) (790d0f7)

Tests

• add coverage for lines detected by pnpm check (#​43589) (d004b52)
• add linter rule to only allow anonymous arrow functions (#​43590) (41cf0b3)

v43.195.6

Compare Source

Miscellaneous Chores

• deps: update dependency protobufjs@​8.0.1 to v8.4.0 (main) (#​43588) (1f04d59)

Build System

• deps: update dependency protobufjs to v8.4.0 (main) (#​43587) (8bb8f83)

v43.195.5

Compare Source

Miscellaneous Chores

• deps: update dependency oxlint-tsgolint to v0.23.0 (main) (#​43585) (1be6bbb)

Build System

• deps: update dependency @​renovatebot/pgp to v1.3.12 (main) (#​43586) (98762c4)

v43.195.4

Compare Source

Build System

• deps: update dependency lru-cache to v11.4.0 (main) (#​43584) (8660ed3)

v43.195.3

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v13.51.3 (main) (#​43583) (9ac8eed)

Documentation

• update references to renovate/renovate (main) (#​43579) (a579edb)
• update references to renovate/renovate to v43.195.2 (main) (#​43582) (ae90795)

Miscellaneous Chores

• deps: lock file maintenance (main) (#​43580) (5c98111)
• deps: update ghcr.io/containerbase/devcontainer docker tag to v14.10.18 (main) (#​43581) (8474da1)

v43.195.2

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v13.51.2 (main) (#​43578) (3f15d2d)

Documentation

• update references to otel/opentelemetry-collector-contrib to v0.152.1 (main) (#​43576) (59face3)
• update references to python to 6928095 (main) (#​43575) (588e536)

Miscellaneous Chores

• deps: update containerbase/internal-tools action to v4.6.34 (main) (#​43557) (c076e06)
• deps: update containerbase/internal-tools action to v4.6.35 (main) (#​43577) (395df6a)
• deps: update ghcr.io/containerbase/devcontainer docker tag to v14.10.17 (main) (#​43574) (012ca22)

v43.195.1

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v13.51.1 (main) (#​43568) (76cd112)

Miscellaneous Chores

• deps: update dependency @​containerbase/istanbul-reports-html to v2.0.5 (main) (#​43564) (2343f77)
• deps: update dependency lint-staged to v17.0.5 (main) (#​43561) (97031dc)
• deps: update dessant/label-actions action to v5.0.3 (main) (#​43555) (8c8b5e4)
• deps: update ghcr.io/containerbase/devcontainer docker tag to v14.10.16 (main) (#​43567) (bd6388b)

v43.195.0

Compare Source

Features

• datasource/github-runners: stabilize arm64 (#​43538) (8986a79)

Miscellaneous Chores

• deps: update dependency @​smithy/util-stream to v4.6.3 (main) (#​43547) (e31a377)

Tests

• test config.cts with actual TypeScript syntax (#​43526) (2160f82)

v43.194.0

Compare Source

Features

• datasource/github-runners: add windows-11-arm label (#​43539) (a0c9453)

v43.193.0

Compare Source

Features

• pip-compile: support --constraint alias and --overrides for uv (#​43485) (934c01d)

Documentation

• prioritise admonitions in config option listings (#​43532) (59d4006)

Miscellaneous Chores

• deps: update github/codeql-action action to v4.36.0 (main) (#​43541) (ba8c1f7)

v43.192.0

Compare Source

Features

• deps: update ghcr.io/renovatebot/base-image docker tag to v13.51.0 (main) (#​43525) (cb2faa8)

v43.191.3

Compare Source

Documentation

• development: pnpm rebuild re2 (#​43509) (cbc655a)

Miscellaneous Chores

• tools/mkdocs: support live reload when modifying docs (#​43516) (0190e1c), closes #​40757

Code Refactoring

• cache: support package cache result predicate (#​43519) (6c6a6b7)

Build System

• deps: update dependency node to v24.16.0 (main) (#​43518) (1009eee)

v43.191.2

Compare Source

Miscellaneous Chores

• deps: update dependency vite to v8.0.13 (main) (#​43512) (3f4610b)
• deps: update dessant/lock-threads action to v6.0.1 (main) (#​43514) (46c5702)

Build System

• deps: update dependency jsonata to v2.2.0 (main) (#​43517) (4620116)

v43.191.1

Compare Source

Bug Fixes

• datasource/rust-version: skip blank lines in manifests.txt (#​43499) (6ad2cfc)

v43.191.0

Compare Source

Features

• deps: update ghcr.io/renovatebot/base-image docker tag to v13.50.0 (main) (#​43507) (0e804c3)

Miscellaneous Chores

• deps: update dependency @​smithy/util-stream to v4.6.2 (main) (#​43501) (2d6635f)
• deps: update dependency pdm to v2.27.0 (main) (#​43506) (a24b9a1)
• renovate: group Zizmor Docker image + Action together (#​43490) (c2607cd), closes #​43361

v43.190.1

Compare Source

Miscellaneous Chores

• deps: update dependency protobufjs@​8.0.1 to v8.3.0 (main) (#​43496) (a1b59a4)

Build System

• deps: update dependency protobufjs to v8.3.0 (main) (#​43495) (67a8025)

v43.190.0

Compare Source

Features

• helmfile: Support release templates (#​42968) (eaf3c81)

v43.189.0

Compare Source

Features

• self-hosted: make user-agent templatable (#​43376) (2d0bd99)

Bug Fixes

• config/validation: validate cacheTtlOverride keys are valid namespaces (#​43478) (321965a)

Miscellaneous Chores

• deps: update ghcr.io/zizmorcore/zizmor docker tag to v1.25.2 (main) (#​43361) (4929140)

v43.188.1

Compare Source

Performance Improvements

• workers/repository: log reconfigure branch cache at TRACE (#​43487) (219f4e9)

v43.188.0

Compare Source

Features

• rust-toolchain: Add rust-toolchain manager (#​38554) (40251b2)

v43.187.0

Compare Source

Features

• monorepo: add vuejs/language-tools to monorepo presets (#​43484) (bc2e194)

v43.186.8

Compare Source

Build System

• deps: update opentelemetry-js-contrib monorepo (main) (#​43479) (818b019)

v43.186.7

Compare Source

Miscellaneous Chores

• deps: update dependency protobufjs@​8.0.1 to v8.2.1 (main) (#​43476) (ccce0f6)

Build System

• deps: update dependency protobufjs to v8.2.1 (main) (#​43475) (245f3db)

v43.186.6

Compare Source

Build System

• deps: update opentelemetry-js monorepo to v0.218.0 (main) (#​43473) (a7bba97)

v43.186.5

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v13.49.3 (main) (#​43471) (c6304b7)

v43.186.4

Compare Source

Bug Fixes

• Support / as tag joiner (#​43460) (4b37e7f)

v43.186.3

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v13.49.2 (main) (#​43469) (535ee81)

v43.186.2

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v13.49.1 (main) (#​43468) (4baca60)

Build System

• deps: update dependency re2 to v1.24.1 (main) (#​43465) (de168b7)

v43.186.1

Compare Source

Build System

• deps: update dependency @​opentelemetry/semantic-conventions to v1.41.1 (main) (#​43458) (1113910)

v43.186.0

Compare Source

Features

• mise: add lock file support (#​42591) (a2b9694), closes #​42099

Bug Fixes

• config/validation: skip validation for templated presets (#​43453) (b720cad)

Documentation

• presets: Define presets as reusable bits of JSON (#​43455) (dd08a07)

Code Refactoring

• prefer templates rather than + in test files (#​43441) (0793274)
• remove string concetation for production code (#​43442) (73b90e9)

Continuous Integration

• enforce templates instead of + string concatenation (#​43440) (f5acd42)

v43.185.1

Compare Source

Bug Fixes

• datasource/github-tags: use GitHub Release published_at for releaseTimestamp (#​43451) (5fa2c6a), closes #​43445

Documentation

• manager/mise: note when short tool name is no longer supported ([#​43421](https://redirect.github.com/renovatebot/re

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • On day 1 of the month (* * 1 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.