chore(deps): update github-actions (non-major)

[mergeraptor]

This PR contains the following updates:

Package	Type	Update	Change
anchore/scan-action	action	patch	v7.4.0 → v7.4.1
github/codeql-action	action	patch	v4.37.6 → v4.37.9
github/codeql-action (changelog)	action	digest	5595cca → cdf488f
hadolint/hadolint-action	action	minor	v3.4.0 → v3.5.0
projectbluefin/testsuite (changelog)	workflow	digest	a01bac3 → ee82d53
renovatebot/github-action	action	patch	v46.2.1 → v46.2.4
reviewdog/action-actionlint	action	patch	v1.73.1 → v1.73.2
taiki-e/install-action (changelog)	action	digest	0aad1e1 → 3a10690

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

anchore/scan-action (anchore/scan-action)

v7.4.1

Compare Source

github/codeql-action (github/codeql-action)

v4.37.9

Compare Source

• Update default CodeQL bundle version to 2.26.4. #​4106

v4.37.8

Compare Source

No user facing changes.

v4.37.7

Compare Source

• Update default CodeQL bundle version to 2.26.3. #​4085

hadolint/hadolint-action (hadolint/hadolint-action)

v3.5.0

Compare Source

Features

• Bump Hadolint to v2.15.1 (941db07)

renovatebot/github-action (renovatebot/github-action)

v46.2.4

Compare Source

Documentation

• update references to renovatebot/github-action to v46.2.3 (42d0056)

Build System

• deps: lock file maintenance (e3c0c2e)

v46.2.3

Compare Source

Documentation

• update references to renovatebot/github-action to v46.2.2 (49f4ea0)

Miscellaneous Chores

• deps: update actions/cache action to v6 (#​1070) (90e0199)
• deps: update actions/setup-node action to v7 (#​1071) (498e972)
• deps: update commitlint monorepo to v21 (#​1073) (22967b6)
• deps: update dependency @​semantic-release/git to v11 (#​1074) (bea653f)
• deps: update dependency @​tsconfig/node24 to v24.0.5 (72cf06d)
• deps: update dependency esbuild to v0.28.2 (0e6d970)
• deps: update dependency eslint-plugin-json to v5 (#​1075) (63f2879)
• deps: update dependency globals to v17.10.0 (d402615)
• deps: update dependency globals to v17.11.0 (675198d)
• deps: update dependency semantic-release to v25.0.9 (ac9a74d)
• deps: update dependency typescript-eslint to v8.66.0 (af5132f)
• deps: update dependency typescript-eslint to v8.67.0 (39cdfd1)
• fix zizmor errors (#​1072) (613ec41)

Build System

• deps: lock file maintenance (7df1c30)

Continuous Integration

• deps: update dependency actions/checkout to v7 (#​1077) (d6180bb)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.17.2 (8695952)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.17.3 (82eda2d)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.20.1 (f478bc0)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.22.0 (755e0d3)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.23.0 (3cb9274)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.23.3 (4436421)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.24.2 (15b3538)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.24.3 (489f1d0)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.25.0 (3683bf4)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.26.0 (e133651)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.27.0 (e22f3f6)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.28.0 (2057af5)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.29.2 (56c415f)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.29.4 (88330ca)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.29.5 (cf40db9)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.30.0 (359d861)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.30.1 (be07738)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.30.2 (4c3519a)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.30.3 (a08a921)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.30.4 (fff9ff0)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.31.0 (e5d35d4)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.32.1 (be027ab)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.32.2 (e5b51b4)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.32.5 (21f4128)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.32.6 (c3a9bd4)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.33.2 (ef454f0)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.34.0 (ec74cb7)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.34.3 (ba4c5a2)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.35.0 (7313a0d)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.35.1 (4e11059)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.35.2 (3ae4864)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.35.3 (f0c13d2)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.35.4 (c16c31c)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.36.0 (8778c4a)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.37.1 (aaaf809)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.38.0 (67e8c5f)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.39.0 (a7eb6cf)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.39.1 (faf9cdc)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.39.2 (2e028a9)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.39.3 (7359be7)

v46.2.2

Compare Source

Documentation

• update references to renovatebot/github-action to v46.2.1 (7cb7826)

Miscellaneous Chores

• deps: update dependency globals to v17.9.0 (fe8cd8f)
• deps: update dependency lint-staged to v17.3.0 (0170d05)
• deps: update dependency npm-run-all2 to v9.0.3 (28cc32f)
• deps: update node.js to v24.19.0 (7871c30)
• deps: update pnpm/action-setup action to v6.0.10 (d50b9ec)

Build System

• deps: lock file maintenance (aff7566)

Continuous Integration

• deps: update ghcr.io/renovatebot/renovate docker tag to v44.10.0 (06d3a61)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.11.0 (01f82e1)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.11.1 (cbdd6e6)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.11.3 (b198ad1)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.11.4 (08eadc2)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.11.6 (90ab0cf)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.11.8 (7450504)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.12.0 (7e359f7)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.13.1 (8a0db28)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.13.2 (aaca99e)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.13.3 (a0789b3)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.14.1 (3c34056)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.14.10 (e7b39a3)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.14.12 (043e499)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.14.3 (#​1069) (c2d39c0)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.14.5 (ed777cd)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.14.7 (670a1df)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.14.8 (b057f09)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.16.1 (7b73ff6)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.17.0 (28c55b1)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.17.1 (216aee1)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.7.4 (9d9a18a)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.8.0 (a339330)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.8.1 (f82ef19)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.9.2 (2a6f771)

reviewdog/action-actionlint (reviewdog/action-actionlint)

v1.73.2

Compare Source

What's Changed

• chore(deps): update shogo82148/actions-create-release action to v1.9.1 by @​renovate[bot] in #​223
• chore(deps): update python:3.14.7-alpine3.24 docker digest to 05b2b8b by @​renovate[bot] in #​224

Full Changelog: reviewdog/action-actionlint@v1.73.1...v1.73.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/anchore/scan-action	8964e60c6fabdb85fdbbbfd9834d8f19c97a3086	🟢 8.2	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ -1 Found no human activity in the last 30 changesets Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches
actions/github/codeql-action/upload-sarif	cdf488f595d80d6e07e03d4674febd5ab45fa938	Unknown	Unknown
actions/github/codeql-action/upload-sarif	cdf488f595d80d6e07e03d4674febd5ab45fa938	Unknown	Unknown

Scanned Files

• .github/workflows/reusable-vulnerability-scan.yml
• .github/workflows/scorecard.yml

[castrojo]

Approved by @castrojo for Hive auto-merge on green CI.