chore(deps): update github-actions [skip ci]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	patch	v6.0.1 → v6.0.3
actions/checkout	action	patch	v6.0.2 → v6.0.3
actions/labeler	action	minor	v6.0.1 → v6.1.0
actions/setup-node	action	minor	v6.3.0 → v6.4.0
actions/setup-node	action	minor	v6.1.0 → v6.4.0
dorny/test-reporter	action	minor	v2.3.0 → v2.7.0
node	uses-with	minor	24.12.0 → 24.18.0
pnpm/action-setup	action	patch	v6.0.4 → v6.0.9
pnpm/action-setup	action	minor	v4.2.0 → v4.4.0
zizmorcore/zizmor-action	action	minor	v0.3.0 → v0.5.7

---

Release Notes

actions/checkout (actions/checkout)

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

actions/labeler (actions/labeler)

v6.1.0

Compare Source

Enhancements

• Add changed-files-labels-limit and max-files-changed configuration options to cap the number of labels added by @​bluca in #​923

Bug Fixes

• Improve Labeler Action documentation and permission error handling by @​chiranjib-swain in #​897
• Preserve manually added labels during workflow runs and refine label synchronization logic by @​chiranjib-swain in #​917

Dependency Updates

• Upgrade brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v6 by @​dependabot in #​877
• Upgrade minimatch from 10.0.1 to 10.2.3 by @​dependabot in #​926
• Upgrade dependencies (@​actions/core, @​actions/github, js-yaml, minimatch, @​typescript-eslint) by @​Copilot in #​934

New Contributors

• @​chiranjib-swain made their first contribution in #​897
• @​bluca made their first contribution in #​923
• @​Copilot made their first contribution in #​934

Full Changelog: actions/labeler@v6...v6.1.0

actions/setup-node (actions/setup-node)

v6.4.0

Compare Source

What's Changed

Dependency updates:

• Upgrade @​actions dependencies by @​Copilot in #​1525
• Update Node.js versions in versions.yml and bump package to v6.4.0 by @​priya-kinthali in #​1533

New Contributors

• @​Copilot made their first contribution in #​1525

Full Changelog: actions/setup-node@v6...v6.4.0

dorny/test-reporter (dorny/test-reporter)

v2.7.0

Compare Source

What's Changed

• Feature: Add slug-prefix output for link anchors #​731
• Feature: Report jest-junit testsuite errors as failures #​155
• Security: Update dependencies to fix reported security vulnerabilities

Other Changes

• Bump eslint from 9.39.3 to 9.39.4 by @​dependabot[bot] in #​732
• Bump @​typescript-eslint/parser from 8.56.1 to 8.57.0 by @​dependabot[bot] in #​733
• Bump jest from 30.2.0 to 30.3.0 by @​dependabot[bot] in #​734
• Bump undici from 6.23.0 to 6.24.1 by @​dependabot[bot] in #​736
• Update flatted package to v3.4.1 to fix a vulnerability by @​jozefizso in #​739

New Contributors

• @​dt-thomas-durand made their first contribution in #​731
• @​johnbartholomew made their first contribution in #​155

Full Changelog: dorny/test-reporter@v2.6.0...v2.7.0

v2.6.0

Compare Source

We updated all dependency packages to latest versions to fix reported security vulnerabilities.

What's Changed

• Fix: For workflow_run events, resolve the commit of the check run from related pull request head commits first (matching workflow_run.head_branch, then first PR), and fall back to workflow_run.head_sha for non-PR runs #​673
• Change: The test-reporter action will listed all artifacts associated with the build run #​693
• Maintenance: Upgrade to ESLint v9 #​629

New Contributors

• @​azchohfi made their first contribution in #​673

Full Changelog: dorny/test-reporter@v2.5.0...v2.6.0

v2.5.0

Compare Source

What's Changed

Features

• Add Nette Tester JUnit Reporter by @​jozefizso in #​707

Project maintanance

• Bump actions/upload-artifact from 5 to 6 by @​dependabot[bot] in #​695

Full Changelog: dorny/test-reporter@v2.4.0...v2.5.0

v2.4.0

Compare Source

What's Changed

• Create tests for sample JUnit files by @​jozefizso in #​701
• Support for the PHPUnit dialect of JUnit by @​mbeccati in #​422
• Use String.substring() function by @​jozefizso in #​704

New Contributors

• @​mbeccati made their first contribution in #​422

Full Changelog: dorny/test-reporter@v2.3.0...v2.4.0

actions/node-versions (node)

v24.18.0: 24.18.0

Compare Source

Node.js 24.18.0

v24.17.0: 24.17.0

Compare Source

Node.js 24.17.0

v24.16.0: 24.16.0

Compare Source

Node.js 24.16.0

v24.15.0: 24.15.0

Compare Source

Node.js 24.15.0

v24.14.1: 24.14.1

Compare Source

Node.js 24.14.1

v24.14.0: 24.14.0

Compare Source

Node.js 24.14.0

v24.13.1: 24.13.1

Compare Source

Node.js 24.13.1

v24.13.0: 24.13.0

Compare Source

Node.js 24.13.0

pnpm/action-setup (pnpm/action-setup)

v6.0.9

Compare Source

What's Changed

• fix: update pnpm to v11.7.0 by @​zkochan in #​267

Full Changelog: pnpm/action-setup@v6...v6.0.9

v6.0.8

Compare Source

What's Changed

• docs(README): fix cache_dependency_path type by @​haines in #​257
• fix: drop patchPnpmEnv so standalone+self-update works on Windows by @​zkochan in #​258
• fix: update pnpm to 11.1.1 by @​mungodewar in #​248

New Contributors

• @​mungodewar made their first contribution in #​248

Full Changelog: pnpm/action-setup@v6.0.7...v6.0.8

v6.0.7

Compare Source

What's Changed

• fix: honor devEngines.packageManager.onFail=error (#​252) by @​zkochan in #​254
• fix: restore inputs from state in post by @​haines in #​255
• fix: self-update bootstrap to packageManager-pinned version (#​233) by @​zkochan in #​256

New Contributors

• @​haines made their first contribution in #​255

Full Changelog: pnpm/action-setup@v6.0.6...v6.0.7

v6.0.6

Compare Source

What's Changed

• fix: bin_dest output points to self-updated pnpm, not bootstrap by @​zkochan in #​249

Full Changelog: pnpm/action-setup@v6.0.5...v6.0.6

v6.0.5

Compare Source

What's Changed

• fix: append (not prepend) action node dir to PATH for npm bootstrap by @​zkochan in #​241

Full Changelog: pnpm/action-setup@v6.0.4...v6.0.5

zizmorcore/zizmor-action (zizmorcore/zizmor-action)

v0.5.7

Compare Source

v0.5.6

Compare Source

• 1.25.2 is now available via the action
• 1.25.2 is now the default version of zizmor used by the action

v0.5.5

Compare Source

This is a no-op release.

v0.5.4

Compare Source

• 1.25.0 is now available via the action
• 1.25.0 is now the default version of zizmor used by the action

v0.5.3

Compare Source

What's Changed

• 1.24.0 and 1.24.1 are now available via the action
• 1.24.1 is now the default version of zizmor used by the action

Full Changelog: zizmorcore/zizmor-action@v0.5.2...v0.5.3

v0.5.2

Compare Source

What's Changed

• zizmor 1.23.1 is now the default used by this action.

Full Changelog: zizmorcore/zizmor-action@v0.5.1...v0.5.2

v0.5.1

Compare Source

What's Changed

• zizmor 1.23.0 is now the default used by this action.

Full Changelog: zizmorcore/zizmor-action@v0.5.0...v0.5.1

v0.5.0

Compare Source

What's Changed

• Expose output-file as an output when advanced-security: true by @​unlobito in #​87

New Contributors

• @​unlobito made their first contribution in #​87

Full Changelog: zizmorcore/zizmor-action@v0.4.1...v0.5.0

v0.4.1

Compare Source

This version fixes an error in the 0.4.0 release that prevented non-relative use
of the action.

What's Changed

• Fix version file path by @​woodruffw in #​83

Full Changelog: zizmorcore/zizmor-action@v0.4.0...v0.4.1

v0.4.0

Compare Source

This new version of zizmor-action brings two major changes:

• The new fail-on-no-inputs option can be used to control whether
  zizmor-action fails if no inputs were collected by zizmor. The default
  remains true, reflecting the pre-existing behavior.

• The action's use of the official zizmor Docker images is now fully
  hash-checked internally, preventing accidental or malicious modification
  to the images. This also means that subsequent releases of zizmor
  will induce a release of this action, rather than the action always picking
  up the latest version by default.

What's Changed

• docs: extended permissions required for internal repos by @​AntoineSebert in #​61
• docs: clarify description of "token" to indicate it is only used for online audits by @​rmuir in #​63
• Hash-check zizmor Docker images by @​woodruffw in #​68
• Add fail-on-no-inputs option by @​woodruffw in #​67

New Contributors

• @​AntoineSebert made their first contribution in #​61
• @​rmuir made their first contribution in #​63

Full Changelog: zizmorcore/zizmor-action@v0.3.0...v0.4.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9460cc2

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords (1)

• [skip ci]

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}