Repository navigation
chore(deps): update github-actions - #169
Merged
Merged
Conversation
renovate
Bot
force-pushed
the
renovate/github-actions
branch
2 times, most recently
from
October 18, 2026 13:54
453cd16 to
2ec6dfe
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/github-actions
branch
3 times, most recently
from
October 24, 2026 16:36
c33840f to
a02273c
Compare
renovate
Bot
force-pushed
the
renovate/github-actions
branch
from
October 25, 2026 05:12
a02273c to
93bd784
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.9.2→v2.9.3v7.0.0→v7.1.0v4.38.3→v4.39.13.14→3.15v3.1.3→v3.1.4Release Notes
Swatinem/rust-cache
v2.9.3Compare Source
What's Changed
New Contributors
Full Changelog: Swatinem/rust-cache@v2.9.2...v2.9.3
actions/setup-python
v7.1.0Compare Source
What's Changed
Enhancements
mirrorandmirror-tokeninputs for custom Python distribution sources by @luhenry in #1302Dependency Upgrade
New Contributors
Full Changelog: actions/setup-python@v7.0.0...v7.1.0
github/codeql-action
v4.39.1Compare Source
v4.39.0Compare Source
codeql-action/analyzestep now validates that a correct argument for thecheckout_pathinput has been provided. Thecheckout_pathinput must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used bycodeql-action/init, then the CodeQL Action now produces a warning. #4148codeql-action/start-proxystep that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic ascodeql-action/init. This primarily benefits customers who are using GitHub instances other thangithub.comwhere thecodeql-action/start-proxystep may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198actions/python-versions (python)
v3.15.1: 3.15.1Compare Source
Python 3.15.1
v3.15.0: 3.15.0Compare Source
Python 3.15.0
sigstore/cosign
v3.1.4Compare Source
Changelog
3428d3cBuild releases with 1.27.3 (#5177)821c9bfAdd AGENTS.md, update contributors.md with reference to AI policy (#5176)cfeaa4aImplementcosign bundle create-from-container(#5144)e2d25b5Mention windows builds in readme (#5147)6a83f9afix(verify): don't panic on a bundle entry with no hash (#5127)0ea1cecrefactor: remove uploadToRekor parameter from ConfirmPrivacyStatementff2a8f4fix(sign): pass digest hash algorithm to underlying signer in SignData7757e8bfix(e2e): enable UseSignedTimestamps in *TSAMTLSWithSigningConfigf624836test(verify): add failure cases for new bundle verification907c3d8fix(sign): propagate BundlePath from SignOptions to KeyOpts0c66ecdclean: update inaccurate warning (#4909)67a1216fix: write referrers when image index has attestations (#5111)ac3a927fix(verify): enforce mutually exclusive key and security key (#5124)048eff5Reorder events in LoadTrustedMaterialAndSigningConfig43d83e8fix(layout): preserve manifest artifactType in index.json when saving (#4821)1dbbc36fix(load): upload bundle layer blobs before manifest PUT81b61e2fix: strip trailing whitespace from attached signature files/stdin (#5058)b327bbafix: clarify COSIGN_REPOSITORY error when repository path is missing3532c1dfix: include annotations in implied payload for offline verifyb84a076Cap the bundle layer read in ociremote.Bundled39ab7cAlign privacy statement prompt behavior (#5076)559c58ccopy annotations by key instead of copying obj (#5103)37cf1bcAdd org.opencontainers.image.title annotation to attestation layers (#4498)dd9ef85feat: Add org.opencontainers.image.source label to images (#5095)00c1772refactor: extract signing flag validation (#5070)39037f1fix: restrict bundle signing and attestation to one artifact (#5081)5b6e930fix: pass missing OIDC flags to KeyOpts (#5079)20c7516fix(verify): support image indexes in local bundle discovery (#5080)81fa4e9fix(verify): propagate CommonVerifyOptions to VerifyCommand (#5094)84effabfix: verify-blob should not force SHA256 for non-default key hash algorithms (#5064)e9af93ffix(providers): clearer errors when GitHub OIDC token request fails (#5062)8b8c87bfeat: --slot option argument shell completion (#5057)0a5f602Deprecate --use-signing-config (#5056)990e273fix: use correct Rekor URLs to activate privacy warning (#5054)151d838fix: only show public-instance privacy statement for the default Rekor URL (#5042)Thanks to all contributors!
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.