fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
actions/checkout	action	minor	v6.0.2 → v6.1.0
actions/setup-go	action	minor	v6.4.0 → v6.5.0
alpine (source)	final	minor	3.23.4 → 3.24.1
alpine (source)	stage	minor	3.23.4 → 3.24.1
codecov/codecov-action	action	patch	v5.5.4 → v5.5.5
github.com/go-vela/server	require	patch	v0.28.6 → v0.28.8
github.com/sirupsen/logrus	require	minor	v1.9.4 → v1.10.1
github.com/urfave/cli/v3	require	minor	v3.9.0 → v3.11.0
github/codeql-action	action	minor	v4.36.0 → v4.37.8

---

Release Notes

actions/checkout (actions/checkout)

v6.1.0

Compare Source

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

actions/setup-go (actions/setup-go)

v6.5.0

Compare Source

codecov/codecov-action (codecov/codecov-action)

v5.5.5

Compare Source

This release only contains the keybase.io change as described here.

Full Changelog: codecov/codecov-action@v5.5.4...v5.5.5

go-vela/server (github.com/go-vela/server)

v0.28.8

Compare Source

What's Changed

• fix: correct install token ttl and set cancel status on CancelRunning by @​ecrupper in #​1471

Full Changelog: go-vela/server@v0.28.7...v0.28.8

v0.28.7

Compare Source

What's Changed

• fix(cache): set proper timeout for build SCM token by @​ecrupper in #​1466
• fix: use app tokens for all hot path SCM calls if app installed by @​ecrupper in #​1464
• fix(cancel): send status update always on cancel update by @​ecrupper in #​1468
• fix(deps): update all non-major dependencies by @​renovate[bot] in #​1458

Full Changelog: go-vela/server@v0.28.6...v0.28.7

sirupsen/logrus (github.com/sirupsen/logrus)

v1.10.1

Compare Source

Logrus v1.10.1

This patch release fixes two issues in field formatting and handling:

• Fix a regression introduced in v1.10.0 where TextFormatter could panic
  when formatting nil or panicking error and fmt.Stringer values.
• Allow function-backed values implementing error to be used with
  WithError, WithField, and WithFields.

Dependency Changes

• update github.com/stretchr/testify to v1.12.0

Full Changelog: sirupsen/logrus@v1.10.0...v1.10.1

v1.10.0

Compare Source

Logrus v1.10.0

This release focuses on substantial performance improvements, concurrency correctness, and better interoperability with modern Go logging APIs.

🚀 Performance

Major improvements across TextFormatter, entry handling, and common logger paths:

• ~17% lower geomean runtime across the benchmark suite
• ~27% higher geomean formatter throughput
• Common enabled logging paths are ~30–44% faster
• WithError is ~40% faster
• Chained fields are ~46% faster
• TextFormatter paths are up to ~40% faster
• Allocation counts are reduced by ~25–74% across measured TextFormatter cases, with the largest reductions in colored output

The improvements also show up in complete logger paths:

• Logger + TextFormatter is ~31% faster, with ~24% fewer allocations
• Logger + JSONFormatter is ~21% faster, with ~10% fewer allocations

JSONFormatter itself remains largely unchanged in runtime performance, with small allocation reductions.

🔄 log/slog interoperability

v1.10 adds bidirectional interoperability between Logrus and Go's log/slog:

• A Logrus slog hook can forward existing Logrus entries to an slog logger.
• hooks/slog.NewHandler implements slog.Handler, allowing log/slog records to use an existing Logrus logger and its hooks, formatter, and output.
• The handler preserves levels, fields, groups, context, record timestamps, and optionally caller information.
• Caller reporting is configured per handler, without requiring Logrus's logger-wide ReportCaller option.
• Custom slog levels can be mapped to Logrus levels.
• The hook and handler can be combined, providing a practical path for incrementally migrating from Logrus to log/slog without requiring an all-at-once transition.

This allows applications to migrate their logging API and logging backend independently: existing Logrus call sites can start using an slog backend, while new slog code can continue using an established Logrus setup.

🔒 Concurrency & Correctness

• Fix reentrant logging deadlocks, including logging from within MarshalJSON or formatter code.
• Fix generic Log, Logf, Logln, and LogFn methods unexpectedly panicking when called with PanicLevel, contrary to their documented behavior.
• Eliminate race conditions in entry and formatter paths.
• Improve locking boundaries around formatters and hooks.

➕ Added

• TextFormatter now automatically enables colors on Windows terminals with ANSI support, matching behavior on other platforms.
• Entry.Caller can now be set explicitly and is preserved across derived entries. When caller reporting is enabled, Logrus only detects and populates caller information when none was provided, allowing custom caller detection and wrapper-aware logging without adding additional caller configuration APIs.
• Add minimal, composable logging interfaces for each log level, allowing consumers to depend on narrower interfaces and making logging implementations easier to substitute or adapt.
• Expand CI verification to include TinyGo and every cross-compile target reported by go tool dist list, improving coverage across alternative toolchains and platforms.

⚠️ Behavioral Changes

• Minimum supported Go version is now 1.23.
• TextFormatter now renders []byte as raw/quoted strings instead of numeric slices.
  If you relied on the previous slice-of-ints output, convert explicitly before logging.
• TextFormatter now uses dim cyan for debug output and dim white for trace output in colorized TTY output.
• Entry.HasCaller is now deprecated in favor of checking Entry.Caller directly. A //go:fix inline directive was added so existing uses can be updated automatically.
• MutexWrap, which was unintentionally exposed as public API, is deprecated. It remains available as an alias for compatibility but should not be used directly.

---

v1.10 is primarily a performance, correctness, and interoperability release with no intentional breaking public API changes.

Benchmarks (sampled at 457e372460c7a80ca7c800b51ebeee5362aaa180)

goos: darwin
goarch: arm64
pkg: github.com/sirupsen/logrus/benches
cpu: Apple M3 Pro
                                     │  v1.9.4.txt   │             v1.10.0.txt              │
                                     │    sec/op     │    sec/op     vs base                │
Entry_WithError                         228.8n ±  4%   137.4n ±  5%  -39.95% (p=0.000 n=10)
Entry_WithField_Chain                  1346.5n ±  2%   733.5n ±  3%  -45.53% (p=0.000 n=10)
Entry_WithFields/valid_fields_only      236.2n ±  6%   255.4n ±  1%   +8.11% (p=0.001 n=10)
Entry_WithFields/contains_func          293.1n ±  3%   285.1n ±  3%   -2.76% (p=0.043 n=10)
Entry_WithFields/contains_func_ptr      296.5n ±  3%   300.1n ±  5%        ~ (p=0.529 n=10)
Entry_WithFields/mixed_valid_invalid    339.7n ±  4%   336.7n ±  2%        ~ (p=0.315 n=10)
Entry_WithFields/larger_map             635.9n ±  4%   693.8n ±  2%   +9.11% (p=0.000 n=10)
Entry_ReportCaller_NoCaller             933.4n ±  3%   924.0n ±  2%        ~ (p=0.105 n=10)
Entry_ReportCaller_WithCaller           2.693µ ±  2%   3.050µ ±  3%  +13.28% (p=0.000 n=10)
Entry_ReportCaller_NoCaller_Depth4      914.3n ±  2%   905.5n ±  3%        ~ (p=0.481 n=10)
Entry_ReportCaller_WithCaller_Depth4    2.736µ ±  8%   3.048µ ±  5%  +11.36% (p=0.000 n=10)
ZeroTextFormatter                       457.6n ±  1%   369.3n ±  2%  -19.31% (p=0.000 n=10)
OneStringTextFormatter                  637.0n ±  1%   549.4n ±  2%  -13.75% (p=0.000 n=10)
OneNumericTextFormatter                 682.7n ±  1%   550.2n ±  1%  -19.42% (p=0.000 n=10)
OneBoolTextFormatter                    669.7n ±  1%   550.0n ±  1%  -17.87% (p=0.000 n=10)
NumericTextFormatter                    1.685µ ±  3%   1.261µ ±  2%  -25.17% (p=0.000 n=10)
BoolTextFormatter                       1.450µ ±  1%   1.082µ ±  3%  -25.39% (p=0.000 n=10)
StringerTextFormatter                   2.066µ ±  1%   1.323µ ±  1%  -35.95% (p=0.000 n=10)
ErrorTextFormatter                      924.7n ±  5%   686.7n ±  1%  -25.74% (p=0.000 n=10)
SmallTextFormatter                      944.4n ±  1%   862.6n ±  1%   -8.66% (p=0.000 n=10)
LargeTextFormatter                      5.527µ ±  5%   4.750µ ±  2%  -14.07% (p=0.000 n=10)
SmallColoredTextFormatter              1337.0n ±  3%   838.6n ±  1%  -37.28% (p=0.000 n=10)
LargeColoredTextFormatter               7.955µ ±  5%   4.749µ ±  3%  -40.30% (p=0.000 n=10)
SmallJSONFormatter                      1.627µ ±  1%   1.637µ ±  6%        ~ (p=0.670 n=10)
LargeJSONFormatter                      8.335µ ±  3%   8.172µ ±  1%   -1.96% (p=0.000 n=10)
DummyLogger                             1.843µ ±  3%   1.551µ ±  2%  -15.82% (p=0.000 n=10)
DummyLoggerNoLock                       1.840µ ±  3%   1.558µ ±  3%  -15.30% (p=0.000 n=10)
LoggerLog/disabled_level                1.248n ± 11%   1.192n ± 11%   -4.49% (p=0.011 n=10)
LoggerLog/enabled_log                   223.9n ±  3%   157.7n ±  5%  -29.57% (p=0.000 n=10)
LoggerLog/enabled_logln                 284.2n ±  1%   158.9n ±  2%  -44.09% (p=0.000 n=10)
LoggerJSONFormatter                     2.177µ ±  1%   1.712µ ±  1%  -21.34% (p=0.000 n=10)
LoggerTextFormatter                     1.860µ ±  5%   1.282µ ±  3%  -31.05% (p=0.000 n=10)
geomean                                 843.9n         698.9n        -17.18%

                                     │   v1.9.4.txt   │              v1.10.0.txt               │
                                     │      B/op      │     B/op      vs base                  │
Entry_WithError                          448.0 ± 0%       448.0 ± 0%        ~ (p=1.000 n=10) ¹
Entry_WithField_Chain                  2.188Ki ± 0%     2.188Ki ± 0%        ~ (p=1.000 n=10) ¹
Entry_WithFields/valid_fields_only       448.0 ± 0%       448.0 ± 0%        ~ (p=1.000 n=10) ¹
Entry_WithFields/contains_func           488.0 ± 0%       488.0 ± 0%        ~ (p=1.000 n=10) ¹
Entry_WithFields/contains_func_ptr       488.0 ± 0%       488.0 ± 0%        ~ (p=1.000 n=10) ¹
Entry_WithFields/mixed_valid_invalid     488.0 ± 0%       488.0 ± 0%        ~ (p=1.000 n=10) ¹
Entry_WithFields/larger_map            1.320Ki ± 0%     1.320Ki ± 0%        ~ (p=1.000 n=10) ¹
Entry_ReportCaller_NoCaller              821.0 ± 0%       800.0 ± 0%   -2.56% (p=0.000 n=10)
Entry_ReportCaller_WithCaller          1.614Ki ± 0%     1.581Ki ± 0%   -2.06% (p=0.000 n=10)
Entry_ReportCaller_NoCaller_Depth4       821.0 ± 0%       800.0 ± 0%   -2.56% (p=0.000 n=10)
Entry_ReportCaller_WithCaller_Depth4   1.614Ki ± 0%     1.581Ki ± 0%   -2.06% (p=0.000 n=10)
ZeroTextFormatter                        272.0 ± 0%       232.0 ± 0%  -14.71% (p=0.000 n=10)
OneStringTextFormatter                   304.0 ± 0%       264.0 ± 0%  -13.16% (p=0.000 n=10)
OneNumericTextFormatter                  308.0 ± 0%       264.0 ± 0%  -14.29% (p=0.000 n=10)
OneBoolTextFormatter                     308.0 ± 0%       264.0 ± 0%  -14.29% (p=0.000 n=10)
NumericTextFormatter                     920.0 ± 0%       808.0 ± 0%  -12.17% (p=0.000 n=10)
BoolTextFormatter                        626.0 ± 0%       552.0 ± 0%  -11.82% (p=0.000 n=10)
StringerTextFormatter                    968.0 ± 0%       808.0 ± 0%  -16.53% (p=0.000 n=10)
ErrorTextFormatter                       472.0 ± 0%       424.0 ± 0%  -10.17% (p=0.000 n=10)
SmallTextFormatter                       528.0 ± 0%       488.0 ± 0%   -7.58% (p=0.000 n=10)
LargeTextFormatter                     3.773Ki ± 0%     3.156Ki ± 0%  -16.36% (p=0.000 n=10)
SmallColoredTextFormatter                600.0 ± 0%       392.0 ± 0%  -34.67% (p=0.000 n=10)
LargeColoredTextFormatter              4.406Ki ± 0%     2.859Ki ± 0%  -35.11% (p=0.000 n=10)
SmallJSONFormatter                     1.078Ki ± 0%     1.070Ki ± 0%   -0.72% (p=0.000 n=10)
LargeJSONFormatter                     5.086Ki ± 0%     5.078Ki ± 0%   -0.15% (p=0.000 n=10)
DummyLogger                              748.0 ± 0%       704.0 ± 0%   -5.88% (p=0.000 n=10)
DummyLoggerNoLock                        748.0 ± 0%       704.0 ± 0%   -5.88% (p=0.000 n=10)
LoggerLog/disabled_level                 0.000 ± 0%       0.000 ± 0%        ~ (p=1.000 n=10) ¹
LoggerLog/enabled_log                    212.0 ± 0%       208.0 ± 0%   -1.89% (p=0.000 n=10)
LoggerLog/enabled_logln                  240.0 ± 0%       208.0 ± 0%  -13.33% (p=0.000 n=10)
LoggerJSONFormatter                    2.156Ki ± 0%     2.125Ki ± 0%   -1.45% (p=0.000 n=10)
LoggerTextFormatter                    1.625Ki ± 0%     1.547Ki ± 0%   -4.81% (p=0.000 n=10)
geomean                                             ²                  -8.14%                ²
¹ all samples are equal
² summaries must be >0 to compute geomean

                                     │  v1.9.4.txt   │             v1.10.0.txt              │
                                     │   allocs/op   │ allocs/op   vs base                  │
Entry_WithError                         3.000 ± 0%     3.000 ± 0%        ~ (p=1.000 n=10) ¹
Entry_WithField_Chain                   15.00 ± 0%     15.00 ± 0%        ~ (p=1.000 n=10) ¹
Entry_WithFields/valid_fields_only      3.000 ± 0%     3.000 ± 0%        ~ (p=1.000 n=10) ¹
Entry_WithFields/contains_func          5.000 ± 0%     5.000 ± 0%        ~ (p=1.000 n=10) ¹
Entry_WithFields/contains_func_ptr      5.000 ± 0%     5.000 ± 0%        ~ (p=1.000 n=10) ¹
Entry_WithFields/mixed_valid_invalid    5.000 ± 0%     5.000 ± 0%        ~ (p=1.000 n=10) ¹
Entry_WithFields/larger_map             5.000 ± 0%     5.000 ± 0%        ~ (p=1.000 n=10) ¹
Entry_ReportCaller_NoCaller             18.00 ± 0%     15.00 ± 0%  -16.67% (p=0.000 n=10)
Entry_ReportCaller_WithCaller           29.00 ± 0%     26.00 ± 0%  -10.34% (p=0.000 n=10)
Entry_ReportCaller_NoCaller_Depth4      18.00 ± 0%     15.00 ± 0%  -16.67% (p=0.000 n=10)
Entry_ReportCaller_WithCaller_Depth4    29.00 ± 0%     26.00 ± 0%  -10.34% (p=0.000 n=10)
ZeroTextFormatter                      10.000 ± 0%     7.000 ± 0%  -30.00% (p=0.000 n=10)
OneStringTextFormatter                 11.000 ± 0%     8.000 ± 0%  -27.27% (p=0.000 n=10)
OneNumericTextFormatter                12.000 ± 0%     8.000 ± 0%  -33.33% (p=0.000 n=10)
OneBoolTextFormatter                   12.000 ± 0%     8.000 ± 0%  -33.33% (p=0.000 n=10)
NumericTextFormatter                    19.00 ± 0%     10.00 ± 0%  -47.37% (p=0.000 n=10)
BoolTextFormatter                      18.000 ± 0%     9.000 ± 0%  -50.00% (p=0.000 n=10)
StringerTextFormatter                   22.00 ± 0%     10.00 ± 0%  -54.55% (p=0.000 n=10)
ErrorTextFormatter                     14.000 ± 0%     9.000 ± 0%  -35.71% (p=0.000 n=10)
SmallTextFormatter                     12.000 ± 0%     9.000 ± 0%  -25.00% (p=0.000 n=10)
LargeTextFormatter                      19.00 ± 0%     14.00 ± 0%  -26.32% (p=0.000 n=10)
SmallColoredTextFormatter              15.000 ± 0%     7.000 ± 0%  -53.33% (p=0.000 n=10)
LargeColoredTextFormatter               46.00 ± 0%     12.00 ± 0%  -73.91% (p=0.000 n=10)
SmallJSONFormatter                      25.00 ± 0%     23.00 ± 0%   -8.00% (p=0.000 n=10)
LargeJSONFormatter                      75.00 ± 0%     73.00 ± 0%   -2.67% (p=0.000 n=10)
DummyLogger                            13.000 ± 0%     9.000 ± 0%  -30.77% (p=0.000 n=10)
DummyLoggerNoLock                      13.000 ± 0%     9.000 ± 0%  -30.77% (p=0.000 n=10)
LoggerLog/disabled_level                0.000 ± 0%     0.000 ± 0%        ~ (p=1.000 n=10) ¹
LoggerLog/enabled_log                   4.000 ± 0%     3.000 ± 0%  -25.00% (p=0.000 n=10)
LoggerLog/enabled_logln                 6.000 ± 0%     3.000 ± 0%  -50.00% (p=0.000 n=10)
LoggerJSONFormatter                     30.00 ± 0%     27.00 ± 0%  -10.00% (p=0.000 n=10)
LoggerTextFormatter                     21.00 ± 0%     16.00 ± 0%  -23.81% (p=0.000 n=10)
geomean                                            ²               -25.77%                ²
¹ all samples are equal
² summaries must be >0 to compute geomean

                          │  v1.9.4.txt  │              v1.10.0.txt              │
                          │     B/s      │      B/s       vs base                │
ZeroTextFormatter           106.3Mi ± 1%    131.7Mi ± 2%  +23.90% (p=0.000 n=10)
OneStringTextFormatter      88.34Mi ± 1%   102.42Mi ± 2%  +15.95% (p=0.000 n=10)
OneNumericTextFormatter     78.23Mi ± 1%    97.08Mi ± 1%  +24.09% (p=0.000 n=10)
OneBoolTextFormatter        82.59Mi ± 1%   100.57Mi ± 1%  +21.77% (p=0.000 n=10)
NumericTextFormatter        74.74Mi ± 3%    99.85Mi ± 2%  +33.60% (p=0.000 n=10)
BoolTextFormatter           65.15Mi ± 1%    87.32Mi ± 3%  +34.04% (p=0.000 n=10)
StringerTextFormatter       64.64Mi ± 1%   100.90Mi ± 1%  +56.10% (p=0.000 n=10)
ErrorTextFormatter          69.10Mi ± 5%    93.05Mi ± 1%  +34.66% (p=0.000 n=10)
SmallTextFormatter          86.85Mi ± 1%    95.08Mi ± 1%   +9.48% (p=0.000 n=10)
LargeTextFormatter          49.35Mi ± 5%    57.43Mi ± 2%  +16.38% (p=0.000 n=10)
SmallColoredTextFormatter   102.7Mi ± 3%    163.8Mi ± 1%  +59.42% (p=0.000 n=10)
LargeColoredTextFormatter   67.14Mi ± 5%   112.45Mi ± 3%  +67.48% (p=0.000 n=10)
SmallJSONFormatter          66.84Mi ± 1%    66.44Mi ± 6%        ~ (p=0.684 n=10)
LargeJSONFormatter          46.91Mi ± 3%    47.85Mi ± 1%   +2.00% (p=0.000 n=10)
geomean                     73.01Mi         92.67Mi       +26.93%

Full Changelog: sirupsen/logrus@v1.9.4...v1.10.0

urfave/cli (github.com/urfave/cli/v3)

v3.11.0

Compare Source

What's Changed

• fix: correct a typo in the help message for the powershell autocompletion by @​suzuki-shunsuke in #​2383
• Escape backslashes in fish completion descriptions by @​mahirhir in #​2378
• chore(deps): bump actions/setup-go from 6 to 7 by @​dependabot[bot] in #​2389
• chore(deps): bump mkdocs-material from 9.7.6 to 9.7.7 in the python-packages group by @​dependabot[bot] in #​2391
• chore(deps): bump actions/setup-python from 6 to 7 by @​dependabot[bot] in #​2390
• fix: skip all hidden flags in shell completion, not just bool flags by @​vidigoat in #​2388
• Fix nil pointer dereference for interface-typed flag values by @​mrueg in #​2400
• Fix index out of range panic when Run is given no arguments by @​mrueg in #​2401
• fix: honor BoolWithInverseFlag DefaultText by @​fzlzjerry in #​2403
• Fix Issue #​2385 by @​BrandonIrizarry in #​2386
• fix: inherit HideHelpCommand in subcommands by @​utkarshalpha in #​2395
• test: cover Run-with-no-arguments paths (#​2406) by @​dearchap in #​2407
• test: add shell-completion case for hidden BoolWithInverseFlag by @​dearchap in #​2408
• test: fix ineffective mutex error-string assertion and add mirror cases by @​dearchap in #​2410

New Contributors

• @​mahirhir made their first contribution in #​2378
• @​vidigoat made their first contribution in #​2388
• @​fzlzjerry made their first contribution in #​2403
• @​BrandonIrizarry made their first contribution in #​2386
• @​utkarshalpha made their first contribution in #​2395

Full Changelog: urfave/cli@v3.10.1...v3.11.0

v3.10.1

Compare Source

What's Changed

• chore(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2371
• fix: align gfmrun example counter with actual runnable count by @​dearchap in #​2369
• v3: yield the version flag's -v alias to a user-defined flag by @​c-tonneslan in #​2330
• fix: keep completion subcommand order deterministic in help output by @​suzuki-shunsuke in #​2374
• fix: allow DefaultCommand to handle its own flags by @​lihan3238 in #​2322

New Contributors

• @​lihan3238 made their first contribution in #​2322

Full Changelog: urfave/cli@v3.10.0...v3.10.1

v3.10.0

Compare Source

What's Changed

• feat: add Flag.SchemaType() and Flag.SchemaItemsType() for JSON Schema introspection by @​dearchap in #​2368
• feat: add Command.Walk() and Command.Path() convenience methods by @​dearchap in #​2353
• fix: let --help flag take precedence over parse errors by @​dearchap in #​2360
• fix: resolve remaining help invocation inconsistencies by @​dearchap in #​2361
• fix: skip After hook when help is displayed on subcommand by @​dearchap in #​2363
• fix: show GLOBAL OPTIONS in SubcommandHelpTemplate by @​dearchap in #​2359
• fix: resolve broken links in CHANGELOG.md by @​dearchap in #​2357
• docs: document what happened to build tags in v3 migration guide by @​dearchap in #​2358
• Various docs updates and dependency bumps

Full Changelog: urfave/cli@v3.9.1...v3.10.0

v3.9.1

Compare Source

What's Changed

• fix: inherit Reader/Writer/ErrWriter from parent on subcommand setup by @​c-tonneslan in #​2329
• fix: correct greedy colon parsing in bash completion script by @​TimSoethout in #​2336
• fix: Honor env sources on duplicated flags by @​ibobgunardi in #​2355
• fix: Remove incorrect flag check by @​MohitPanchariya in #​2280
• fix: let completion command use normal flag parsing pipeline by @​suzuki-shunsuke in #​2279
• fix: bash completion spacing by @​cyphercodes in #​2337
• fix: fish custom completion arguments by @​puneetdixit200 in #​2338
• fix: empty positional arg after a flag regression test by @​c-tonneslan in #​2328
• docs: document build tags in v3 migration guide by @​dearchap in #​2358
• chore(deps): bump mkdocs-git-revision-date-localized-plugin by @​dependabot in #​2347
• Fix typos by @​myfloss in #​2339

Full Changelog: urfave/cli@v3.9.0...v3.9.1

github/codeql-action (github/codeql-action)

v4.37.8

Compare Source

v4.37.7

Compare Source

• Update default CodeQL bundle version to 2.26.3. #​4085

v4.37.6

Compare Source

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #​4070

v4.37.5

Compare Source

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #​4061

v4.37.4

Compare Source

v4.37.3

Compare Source

No user facing changes.

v4.37.2

Compare Source

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #​4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #​4007

v4.37.1

Compare Source

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #​3956
• Update default CodeQL bundle version to 2.26.1. #​4019

v4.37.0

Compare Source

• Update default CodeQL bundle version to 2.26.0. #​3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #​3973

v4.36.3

Compare Source

No user facing changes.

v4.36.2

Compare Source

• Cache CodeQL CLI version information across Actions steps. #​3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #​3937
• Update default CodeQL bundle version to 2.25.6. #​3948

v4.36.1

Compare Source

No user facing changes.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 38.71%. Comparing base (b0a8408) to head (23936aa).

❌ Your project check has failed because the head coverage (38.71%) is below the target coverage (90.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #181   +/-   ##
=======================================
  Coverage   38.71%   38.71%           
=======================================
  Files           7        7           
  Lines         421      421           
=======================================
  Hits          163      163           
  Misses        244      244           
  Partials       14       14           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
golang.org/x/sys	v0.44.0 -> v0.45.0