[renovate]

This PR contains the following updates:

Package	Type	Update	Change
aquasecurity/trivy	uses-with	patch	v0.76.1 → v0.76.2
azure/setup-helm	action	minor	v5.0.1 → v5.1.0
docker/login-action	action	minor	v4.7.0 → v4.8.0
github/codeql-action	action	patch	v4.39.2 → v4.39.3
sigstore/cosign-installer	action	patch	v4.1.2 → v4.1.3
softprops/action-gh-release	action	patch	v3.0.3 → v3.0.4

---

Release Notes

aquasecurity/trivy

v0.76.2

Compare Source

🔐 Security update 🛡️

Trivy v0.76.2 bundles several security fixes:

• Official container images are rebuilt on Alpine 3.24.3, which fixes musl/musl-utils (CVE-2026-107891), and the build picks up fixed libcurl (24 CVEs, including HIGH CVE-2026-92392) and brotli-libs (CVE-2026-111497) from the v3.24 package repository.
• golang.org/x/net is bumped to v0.62.0, fixing two vulnerabilities in golang.org/x/net/html: CVE-2026-78661 (quadratic complexity when coalescing text nodes) and CVE-2026-97045 (missing ancestor namespace check when rendering raw text).
• github.com/go-jose/go-jose/v4 is bumped to v4.1.6, fixing GHSA-mgcc-cww5-fp2q.

We recommend upgrading to v0.76.2 and redeploying container images to apply these updates.

Changelog

• 3f6334d release: v0.76.2 [release/v0.76] (#​11552)
• 1cabe83 fix(deps): bump golang.org/x/net from 0.61.0 to 0.62.0 [backport: release/v0.76] (#​11554)
• be08de4 chore(deps): bump the common group across 1 directory with 14 updates [backport: release/v0.76] (#​11555)
• a8537d3 fix(deps): bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 [backport: release/v0.76] (#​11553)
• ae26b88 fix(deps): bump alpine to 3.24.3 in container images [backport: release/v0.76] (#​11551)

azure/setup-helm

v5.1.0

Compare Source

Added

• #​281 Read the Helm version from a .tool-versions file with the version-file input
• #​293 Resolve the latest patch for a major.minor version
• #​315 Add configurable checksum verification and fallback download mirrors

Fixed

• #​292 Preserve subpath base URLs when constructing Helm download URLs
• #​303 Retry latest-version lookups and add the latest-fallback opt-out

Security

• #​313 Update Undici security fixes
• #​307 Update Undici
• #​298 Update Undici

Changed

• #​314 Update the built-in Helm fallback from v3.18.4 to v4.3.1
• #​311 Enable stale cleanup after 74 inactive days
• #​306 Update the shared release workflow
• Update remaining dependency groups, development tools, and workflow actions (#​290, #​291, #​294, #​295, #​297, #​299, #​301, #​305, #​308, #​309, #​316)

docker/login-action

v4.8.0

Compare Source

• Set Docker Hub OIDC token lifetime default to 1 hour by @​crazy-max in #​1070
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1161.0 in #​1103
• Bump @​docker/actions-toolkit from 0.107.0 to 0.109.0 in #​1105
• Bump vite from 7.3.6 to 7.3.7 in #​1101

Full Changelog: docker/login-action@v4.7.0...v4.8.0

github/codeql-action

v4.39.3

Compare Source

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #​4283

sigstore/cosign-installer

v4.1.3

Compare Source

What's Changed

• Bump Cosign to v3.1.4 (latest release) in #​257

Full Changelog: sigstore/cosign-installer@v4.1.2...v4.1.3

softprops/action-gh-release

v3.0.4

Compare Source

• maintenance release with updated dependencies

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud