chore(deps): update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-node	action	minor	v4.1.0 -> v4.2.0
github/codeql-action	action	patch	v3.28.1 -> v3.28.9
golangci/golangci-lint-action	action	minor	v6.2.0 -> v6.3.2
slsa-framework/slsa-verifier	action	minor	v2.6.0 -> v2.7.0

---

Release Notes

actions/setup-node (actions/setup-node)

v4.2.0

Compare Source

github/codeql-action (github/codeql-action)

v3.28.9

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.9 - 07 Feb 2025

• Update default CodeQL bundle version to 2.20.4. #​2753

See the full CHANGELOG.md for more information.

v3.28.8

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.8 - 29 Jan 2025

• Enable support for Kotlin 2.1.10 when running with CodeQL CLI v2.20.3. #​2744

See the full CHANGELOG.md for more information.

v3.28.7

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.7 - 29 Jan 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.28.6

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.6 - 27 Jan 2025

• Re-enable debug artifact upload for CLI versions 2.20.3 or greater. #​2726

See the full CHANGELOG.md for more information.

v3.28.5

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.5 - 24 Jan 2025

• Update default CodeQL bundle version to 2.20.3. #​2717

See the full CHANGELOG.md for more information.

v3.28.4

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.4 - 23 Jan 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.28.3

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.3 - 22 Jan 2025

• Update default CodeQL bundle version to 2.20.2. #​2707
• Fix an issue downloading the CodeQL Bundle from a GitHub Enterprise Server instance which occurred when the CodeQL Bundle had been synced to the instance using the CodeQL Action sync tool and the Actions runner did not have Zstandard installed. #​2710
• Uploading debug artifacts for CodeQL analysis is temporarily disabled. #​2712

See the full CHANGELOG.md for more information.

v3.28.2

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.2 - 21 Jan 2025

No user facing changes.

See the full CHANGELOG.md for more information.

golangci/golangci-lint-action (golangci/golangci-lint-action)

v6.3.2

Compare Source

What's Changed

Changes

• fix: path patch by @​ldez in https://github.com/golangci/golangci-lint-action/pull/1162

Dependencies

• build(deps-dev): bump prettier from 3.4.2 to 3.5.0 in the dev-dependencies group by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1160

Full Changelog: golangci/golangci-lint-action@v6.3.1...v6.3.2

v6.3.1

Compare Source

What's Changed

Changes

• fix: restrict patched version to v1 by @​ldez in https://github.com/golangci/golangci-lint-action/pull/1158
• chore: update golangci-lint versions by @​ldez in https://github.com/golangci/golangci-lint-action/pull/1159

Dependencies

• build(deps-dev): bump the dev-dependencies group with 2 updates by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1155
• build(deps): bump @​types/node from 22.13.0 to 22.13.1 in the dependencies group by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1156

Full Changelog: golangci/golangci-lint-action@v6.3.0...v6.3.1

v6.3.0

Compare Source

What's Changed

Changes

• chore: use new assets file by @​ldez in https://github.com/golangci/golangci-lint-action/pull/1154

Documentation

• docs: update README options version from required to optional by @​otakakot in https://github.com/golangci/golangci-lint-action/pull/1145

Dependencies

• build(deps-dev): bump the dev-dependencies group with 4 updates by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1146
• build(deps): bump the dependencies group with 2 updates by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1147
• build(deps-dev): bump the dev-dependencies group with 2 updates by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1148
• build(deps): bump @​types/node from 22.10.7 to 22.10.10 in the dependencies group by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1149
• build(deps): bump undici from 5.28.4 to 5.28.5 by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1150
• build(deps-dev): bump the dev-dependencies group with 2 updates by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1152
• build(deps): bump @​types/node from 22.10.10 to 22.13.0 in the dependencies group by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1153

New Contributors

• @​otakakot made their first contribution in https://github.com/golangci/golangci-lint-action/pull/1145

Full Changelog: golangci/golangci-lint-action@v6.2.0...v6.3.0

slsa-framework/slsa-verifier (slsa-framework/slsa-verifier)

v2.7.0

Compare Source

What's Changed

• chore: v2.6.0: update docs by @​ramonpetgrave64 in https://github.com/slsa-framework/slsa-verifier/pull/789
• chore: Update CODEOWNERS to use teams by @​haydentherapper in https://github.com/slsa-framework/slsa-verifier/pull/793
• chore(deps): bump github.com/docker/docker from 24.0.9+incompatible to 26.1.4+incompatible in the go_modules group by @​dependabot in https://github.com/slsa-framework/slsa-verifier/pull/794
• feat: support npm cli provenance v1 attestations by @​ramonpetgrave64 in https://github.com/slsa-framework/slsa-verifier/pull/776
• chore: pin yamllint, golangci-lint by @​ramonpetgrave64 in https://github.com/slsa-framework/slsa-verifier/pull/783
• feat: refactor: use sigstore-go for fetching TrustedRoot by @​ramonpetgrave64 in https://github.com/slsa-framework/slsa-verifier/pull/791
• chore(deps): update golang:1.21 docker digest to f2eb989 by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/796
• chore(deps): bump github.com/docker/docker from 26.1.4+incompatible to 26.1.5+incompatible in the go_modules group by @​dependabot in https://github.com/slsa-framework/slsa-verifier/pull/798
• chore: fix vuln: override autolinker ^4.0.0 by @​ramonpetgrave64 in https://github.com/slsa-framework/slsa-verifier/pull/785
• chore(config): migrate renovate config by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/800
• feat: set user-agent header on Rekor requests by @​bobcallaway in https://github.com/slsa-framework/slsa-verifier/pull/801
• feat: handle dssev001 tlog entry types by @​ramonpetgrave64 in https://github.com/slsa-framework/slsa-verifier/pull/799
• fix(deps): update golang.org/x/exp digest to 225e2ab by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/803
• chore(deps): update dependency pyyaml to v6.0.2 by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/808
• chore(deps): update golang:1.21 docker digest to 4746d26 by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/802
• fix(deps): update dependency org.apache.maven:maven-plugin-api to v3.9.9 by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/809
• chore: update go and golanci lint by @​ramonpetgrave64 in https://github.com/slsa-framework/slsa-verifier/pull/810
• feat(action): Updating to Node20 by @​IAreKyleW00t in https://github.com/slsa-framework/slsa-verifier/pull/811
• fix(deps): update module github.com/sigstore/sigstore-go to v0.6.1 [security] by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/805
• chore(deps): update gcr.io/distroless/base:nonroot docker digest to e5260be by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/795
• chore(deps): bump github.com/sigstore/sigstore-go from 0.6.1 to 0.6.2 in the go_modules group across 1 directory by @​dependabot in https://github.com/slsa-framework/slsa-verifier/pull/812
• fix: fix method for getting leaf certs in Bundle v0.3 by @​ramonpetgrave64 in https://github.com/slsa-framework/slsa-verifier/pull/813
• chore(deps): update github-actions by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/817
• chore(deps): update golang docker tag to v1.23 by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/818
• fix(deps): update dependency @​actions/core to v1.11.1 by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/819
• chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.0.0 to 2.0.1 in the go_modules group by @​dependabot in https://github.com/slsa-framework/slsa-verifier/pull/820
• chore(deps): bump golang.org/x/crypto from 0.27.0 to 0.31.0 in the go_modules group by @​dependabot in https://github.com/slsa-framework/slsa-verifier/pull/821
• fix(deps): update dependency org.apache.maven:maven-core to v3.9.9 by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/816
• fix(deps): update dependency org.apache.maven.plugin-tools:maven-plugin-annotations to v3.15.1 by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/824
• chore(deps): update github-actions by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/823
• chore(deps): bump golang.org/x/net from 0.27.0 to 0.33.0 in the go_modules group by @​dependabot in https://github.com/slsa-framework/slsa-verifier/pull/826
• fix(deps): update go by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/825
• chore(deps): update golang:1.23 docker digest to 51a6466 by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/822
• fix(deps): update golang.org/x/exp digest to 3edf0e9 by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/815
• chore(deps): update gcr.io/distroless/base:nonroot docker digest to 97d1521 by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/814
• chore(deps): bump undici from 5.28.4 to 5.28.5 in /actions/installer in the npm_and_yarn group across 1 directory by @​dependabot in https://github.com/slsa-framework/slsa-verifier/pull/827

New Contributors

• @​bobcallaway made their first contribution in https://github.com/slsa-framework/slsa-verifier/pull/801
• @​IAreKyleW00t made their first contribution in https://github.com/slsa-framework/slsa-verifier/pull/811

Full Changelog: slsa-framework/slsa-verifier@v2.6.0...v2.7.0

---

Configuration

📅 Schedule: Branch creation - "* 0-3 1 * *" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.