Skip to content

chore(deps): update dependencies (minor) - #19

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-updates
Open

chore(deps): update dependencies (minor)#19
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-updates

Conversation

@renovate

@renovate renovate Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
amannn/action-semantic-pull-request action minor v6 → v6.1.2
docker/login-action action minor v4 → v4.8.0
github/codeql-action action minor v4.37.7 → v4.39.3
open-component-model/open-component-model minor 0.22.1 → 0.23.0
ossf/scorecard-action action minor v2.4.4 → v2.5.0
wagoid/commitlint-github-action action minor v6 → v6.2.1
zizmorcore/zizmor-action action minor v0.6.4 → v0.8.1

Release Notes

amannn/action-semantic-pull-request

v6.1.2

Compare Source

Bug Fixes

v6.1.1

Compare Source

Bug Fixes

v6.1.0

Compare Source

Features
Bug Fixes
  • Remove trailing whitespace from "unknown release type" error message (#​291) (afa4edb)

v6.0.1

Compare Source

Bug Fixes
docker/login-action

v4.8.0

Compare Source

Full Changelog: docker/login-action@v4.7.0...v4.8.0

v4.7.0

Compare Source

Full Changelog: docker/login-action@v4.6.0...v4.7.0

v4.6.0

Compare Source

Full Changelog: docker/login-action@v4.5.2...v4.6.0

v4.5.2

Compare Source

Full Changelog: docker/login-action@v4.5.1...v4.5.2

v4.5.1

Compare Source

Full Changelog: docker/login-action@v4.5.0...v4.5.1

v4.5.0

Compare Source

Full Changelog: docker/login-action@v4.4.0...v4.5.0

v4.4.0

Compare Source

Full Changelog: docker/login-action@v4.3.0...v4.4.0

v4.3.0

Compare Source

Full Changelog: docker/login-action@v4.2.0...v4.3.0

v4.2.0

Compare Source

Full Changelog: docker/login-action@v4.1.0...v4.2.0

v4.1.0

Compare Source

Full Changelog: docker/login-action@v4.0.0...v4.1.0

github/codeql-action

v4.39.3

Compare Source

  • Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #​4283

v4.39.2

Compare Source

  • Update default CodeQL bundle version to 2.27.4. #​4284
  • Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4266
  • Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #​4221
  • The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #​4243

v4.39.1

Compare Source

v4.39.0

Compare Source

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #​4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #​4198

v4.38.3

Compare Source

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4188
  • Update default CodeQL bundle version to 2.27.2. #​4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #​4184

v4.38.2

Compare Source

v4.38.1

Compare Source

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #​4146

v4.38.0

Compare Source

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #​4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #​4072
  • Update default CodeQL bundle version to 2.27.0. #​4129

v4.37.9

Compare Source

v4.37.8

Compare Source

No user facing changes.

open-component-model/open-component-model

v0.23.0: OCM 0.23.0

Compare Source

Promoted from v0.23.0-rc.2 on 2026-11-06

[0.23.0] - 2026-11-06

🚀 Features
  • (ci) Harden images against the DISA GPOS SRG and the CIS Docker Benchmark (#​3978)
  • (transfer) Transfer unpinned Git resources by value with a drift warning (#​4040)
  • (cli) Select default verifier from signature algorithm (#​4045)
  • (transfer) Add unmatchedResourcePolicy to the transfer config (#​4009)
  • Add performance suite (#​3791)
  • (ctf) Stream blobs of unknown digest or size into a CTF via staged files (#​4057)
  • (controllers) [breaking] Use OCI cache instead of resolution service (#​3829)
  • (wget) [breaking] Stream downloads instead of buffering to a temp file (#​3939)
  • (signing) [breaking] Default new signatures to jsonNormalisation/v4alpha3 (#​4006)
  • (blob) Add Remove to filesystem.Blob (#​4102)
  • (controller) [breaking] Verify resource digests without downloading where possible (#​4109)
🐛 Bug Fixes
  • (transfer) Upload legacy OCI artifact sets (#​4037)
  • (sigstore) Wait for knative webhook before patching config-network (#​4039)
  • (sigstore) Retry knative config-network patch until the webhook answers (#​4046)
  • (http) Make transfers survive HTTP/2 connection loss (#​4007)
  • Stop reacting to our own create event from the deployer (#​4048)
  • Render godoc structure in schema descriptions (#​4035)
  • (cli) [breaking] Replace existing component versions by default (#​4036)
  • Resolve data races surfaced by go test -race (#​4088)
  • (ctf) Recognize docker artifact set media types (#​4089)
  • (descriptor) Omit unset component reference digest (#​4096)
  • (blob) [breaking] Stop holding an os.Root in read-only OS path blobs (#​4087)
  • (oci) Avoid copying extracted tar and write end-of-archive marker (#​4083)
  • (oci) Copy nested-manifest local blobs directly between stores (#​4079)
  • (blob) Stream single-file path blobs from disk without leaking the file (#​4077)
  • (ctf) Don't hold the archive lock while streaming blobs (#​4105)
  • (ctf) Make blob staging optional and safe against concurrent publishes (#​4108)
  • (repository) [breaking] Bind every downloaded resource to its descriptor digest (#​4085)
  • (s3) [breaking] Stream downloads instead of leaving temporary files (#​4113)
  • (oci) Join in-flight resolver in refcache Always concurrency test (#​4114)
  • (oci) Accept resources excluded from signature on upload (#​4164 + #​4081) (#​4168)
📦 Dependencies
  • (deps) Update module github.com/onsi/gomega to v1.44.0 (#​4031)
  • (deps) Update go-openapi packages (#​4024)
  • (deps) Update module github.com/klauspost/compress to v1.20.1 (#​4026)
  • (deps) Update digest pins (#​4022)
  • (deps) Update module github.com/ebitengine/purego to v0.11.1 (#​4025)
  • (deps) Update module github.com/pb33f/ordered-map/v2 to v2.3.2 (#​4027)
  • (deps) Update kubernetes dependencies to v0.37.1 (#​4029)
  • (deps) Update ocm cosign (#​4020)
  • (deps) Update aws-sdk-go-v2 monorepo (#​4028)
  • (deps) Update ghcr.io/open-component-model/kubernetes/controller:latest docker digest to 31080f0 (#​4023)
  • (deps) Update registry docker tag to v3.1.1 (#​4062)
  • (deps) Update module github.com/go-jose/go-jose/v4 to v4.1.6 [security] (#​4073)
  • (deps) Update ocm cosign (#​4092)
⚡ Performance
  • (oci) Read legacy artifact sets as OCI layouts without conversion (#​4044)
  • (blob) [breaking] Use pooled copy buffers and gzip writers on blob paths (#​4058)
  • (oci) Stream OCI image layers lazily instead of loading them into memory (#​4080)
  • (blob) Keep io.ReaderAt on direct blob readers for tar extraction (#​4084)
  • (blob) Keep io.WriterTo for byte-backed direct blobs (#​4082)
  • (oci) Hash a local resource blob once before upload (#​4099)
  • (oci) [breaking] Pool chunked push buffers and keep chunked push behind the cache (#​4068)
🚜 Refactor
  • (oci) [breaking] Make DescriptorBlob lazy (#​4049)
⚙️ Miscellaneous Tasks
  • (ci) Fail link checks on PRs for findings outside the diff (#​4038)
  • (fix) Stop returning early on a config change (#​4050)
  • [breaking] Deprecate component sources (#​4047)
  • Slight logical adjustment and documenting the rate limiting and concurrency settings (#​4093)
📚 Documentation
  • Clarify that all built-in access types work natively with ocm download (#​4052)

Get This Release

Install the OCM CLI
curl -sfL https://ocm.software/install-cli.sh | OCM_VERSION=0.23.0 bash

For alternative installation options, see the installation guide.

You can also run the OCM CLI in a container without installing it:

docker run --rm -t ghcr.io/open-component-model/cli:0.23.0 --help

See the container image guide for more details.

Deploy the OCM Controller

Install into a Kubernetes cluster via Helm:

helm install ocm-k8s-toolkit oci://ghcr.io/open-component-model/kubernetes/controller/chart \
--version 0.23.0 \
--namespace ocm-k8s-toolkit-system \
--create-namespace

See the controller setup guide for full configuration options.

OCM Component Distribution (for existing OCM users)

Every OCM release is published as OCM component versions to ghcr.io/open-component-model - the same distribution mechanism OCM enables for your own software. Components in this release:

Component Contents
ocm.software/ocm:0.23.0 Product wrapper referencing CLI + controller
ocm.software/cli:0.23.0 CLI binaries and OCI image
ocm.software/kubernetes/controller:0.23.0 Controller image and Helm chart

Inspect the full product component:

ocm get component-version ghcr.io/open-component-model//ocm.software/ocm:0.23.0 -o yaml

Download a CLI binary directly via OCM (requires OCM CLI already installed; replace os and architecture as needed — e.g. linux/amd64, darwin/arm64):

ocm download resource ghcr.io/open-component-model//ocm.software/cli:0.23.0 \
--identity os=linux,architecture=amd64
Community & Contributors

This release we had a total of 7 contributors!
If you want to engage with us, check our community page!

ossf/scorecard-action

v2.5.0

Compare Source

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted
services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the
Scorecard v5.6.0 release notes.

  • The action's container image is built with Go 1.27.2 on a refreshed distroless base. by
    @​justaugustus in #​1716
  • The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still
    recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @​justaugustus in #​1716
  • The Scorecard version in results now always matches the Scorecard release the action is built
    with. by @​justaugustus in #​1718
  • The action no longer prints the GitHub token variable while validating its options. by
    @​arpitjain099 in #​1709
  • results_format accepts intoto, which wraps the JSON results in an in-toto attestation
    statement. by @​puerco in #​1702
Other

New Contributors

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

wagoid/commitlint-github-action

v6.2.1

Compare Source

v6.2.0

Compare Source

v6.1.2

Compare Source

v6.1.1

Compare Source

v6.1.0

Compare Source

v6.0.2

Compare Source

v6.0.1

Compare Source

zizmorcore/zizmor-action

v0.8.1

Compare Source

Sponsorship is appreciated!

zizmor 1.32 is now the default version used by this action.

Full release notes: https://docs.zizmor.sh/release-notes/#​1320

Full Changelog: zizmorcore/zizmor-action@v0.8.0...v0.8.1

v0.8.0

Compare Source

The action now supports prereleases.

The default has not changed, but you can pass a prerelease version
of zizmor or version: prerelease to get whatever latest
prerelease the action knows about.

What's Changed

Full Changelog: zizmorcore/zizmor-action@v0.7.1...v0.8.0

v0.7.1

Compare Source

zizmor changes
Bug Fixes 🐛🔗
  • Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit
action changes

The default version of zizmor is now 1.31.1.

What's Changed

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Compare Source

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

  • The typosquat-uses audit now supports pre-commit config inputs (#​2437)

  • The self-hosted-runner audit is now significantly more precise (#​2350)

    Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

  • The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#​2396)

  • zizmor is now aware of the image_version workflow trigger (#​2397)

  • The dangerous-triggers audit now produces more precise finding/diagnostic spans (#​2402)

  • The cache-poisoning audit is now aware of pnpm/setup (#​2409)

  • The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#​2395)

    Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

  • The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#​2418)

  • The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#​2426)

  • zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#​2444)

Bug Fixes 🐛🔗

  • Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#​2386)

    Many thanks to @​marcalexiei for implementing this improvement!

  • Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#​2390)

  • Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#​2394)

  • Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#​2413)

  • Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#​2444)

action notes

What's Changed

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 5am on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the ok-to-image PR is allowed to run container build label Sep 14, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch 2 times, most recently from 2de4ba4 to 1b479a9 Compare September 21, 2026 22:32
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch 2 times, most recently from 568ebd7 to 7878726 Compare September 28, 2026 21:46
@renovate renovate Bot added the ok-to-e2e label Oct 2, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch from 7878726 to 488892f Compare October 2, 2026 12:52
@Perseus985

Perseus985 commented Oct 8, 2026

Copy link
Copy Markdown
Collaborator

Waiting on 0.19.0 because it has bugfixes with the digest transfer that we should definetly have

@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch from 488892f to cdb1192 Compare October 9, 2026 13:40
Perseus985
Perseus985 previously approved these changes Oct 11, 2026
View reviewed changes

@Perseus985 Perseus985 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

With 019.0 it should be good. But we have to look at:
https://ocm.software/docs/how-to/migrate-from-upload-as/

@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch from cdb1192 to 38859c1 Compare October 11, 2026 10:46
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch 5 times, most recently from 02c5850 to dbb2d4b Compare October 18, 2026 13:05
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch 2 times, most recently from 26957f7 to bcfe1f8 Compare October 24, 2026 17:59
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch from bcfe1f8 to ba0e6ac Compare October 26, 2026 09:40
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch from 0e5df44 to 584bdc1 Compare November 2, 2026 17:00
@Perseus985 Perseus985 mentioned this pull request Nov 4, 2026
Merged
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch 8 times, most recently from 98f9df6 to 428af2d Compare November 9, 2026 18:46
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch from 428af2d to 33b15ad Compare November 11, 2026 12:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Perseus985 Perseus985 Perseus985 left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

ok-to-e2e ok-to-image PR is allowed to run container build

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Perseus985