chore(deps): bump the actions-weekly group across 1 directory with 8 updates

[dependabot]

Bumps the actions-weekly group with 8 updates in the / directory:

Package	From	To
crate-ci/typos	1.46.1	1.47.2
github/codeql-action	4.35.4	4.36.2
taiki-e/install-action	2.77.6	2.81.4
docker/login-action	4.1.0	4.2.0
docker/metadata-action	6.0.0	6.1.0
depot/build-push-action	1.17.0	1.18.0
mikepenz/release-changelog-builder-action	6.2.1	6.2.2
actions/stale	10.2.0	10.3.0

Updates crate-ci/typos from 1.46.1 to 1.47.2

Release notes

Sourced from crate-ci/typos's releases.

v1.47.2

[1.47.2] - 2026-06-04

Fixes

• Don't correct inferrable
• Correct unused inferible variant

v1.47.1

[1.47.1] - 2026-06-03

Fixes

• Don't correct requestors

v1.47.0

[1.47.0] - 2026-05-29

Features

• Updated the dictionary with the May 2026 changes

v1.46.3

[1.46.3] - 2026-05-23

Fixes

• Don't correct to sequentials
• Don't correct to subdolder

v1.46.2

[1.46.2] - 2026-05-16

Fixes

• Don't correct to criterias
• Don't correct to replaceables

Changelog

Sourced from crate-ci/typos's changelog.

Change Log

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

[Unreleased] - ReleaseDate

[1.47.2] - 2026-06-04

Fixes

• Don't correct inferrable
• Correct unused inferible variant

[1.47.1] - 2026-06-03

Fixes

• Don't correct requestors

[1.47.0] - 2026-05-29

Features

• Updated the dictionary with the May 2026 changes

[1.46.3] - 2026-05-23

Fixes

• Don't correct to sequentials
• Don't correct to subdolder

[1.46.2] - 2026-05-16

Fixes

• Don't correct to criterias
• Don't correct to replaceables

[1.46.1] - 2026-05-08

Fixes

• Don't correct to confidentials

[1.46.0] - 2026-04-30

... (truncated)

Commits

• 37bb988 chore: Release
• cf0d280 docs: Update changelog
• 365762c Merge pull request #1569 from epage/infer
• ee20d2a fix(dict): Allow inferrable, disallow inferible
• 44e2070 chore: Release
• e10d108 docs: Update changelog
• 06f8734 Merge pull request #1566 from epage/fix
• a12d104 fix(dict): Don't correct requestors
• 823a0a4 chore(deps): Update compatible (#1564)
• f8a58b6 chore: Release
• Additional commits viewable in compare view

Updates github/codeql-action from 4.35.4 to 4.36.2

Release notes

Sourced from github/codeql-action's releases.

v4.36.2

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

v4.36.1

No user facing changes.

v4.36.0

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

v4.35.5

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

• Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
• Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
• Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
• Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
• Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795
• The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789
• Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794
• Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807
• Update default CodeQL bundle version to 2.25.2. #3823

... (truncated)

Commits

• 8aad20d Merge pull request #3949 from github/update-v4.36.2-dcb947ce1
• f521b08 Add additional changelog notes
• 8aeff0f Update changelog for v4.36.2
• dcb947c Merge pull request #3948 from github/update-bundle/codeql-bundle-v2.25.6
• c251bce Add changelog note
• 62953c1 Update default bundle to codeql-bundle-v2.25.6
• 423b570 Merge pull request #3946 from github/dependabot/npm_and_yarn/npm-minor-5d507a...
• c35d1b1 Merge pull request #3947 from github/dependabot/github_actions/dot-github/wor...
• cb1a588 Merge pull request #3937 from github/robertbrignull/waitForProcessing_backoff
• ba47406 Merge pull request #3943 from github/henrymercer/cache-cli-version-info
• Additional commits viewable in compare view

Updates taiki-e/install-action from 2.77.6 to 2.81.4

Release notes

Sourced from taiki-e/install-action's releases.

2.81.4

• Update vacuum@latest to 0.28.4.

• Update typos@latest to 1.47.1.

• Update syft@latest to 1.45.0.

• Update cargo-neat@latest to 0.4.0.

• Update cargo-mutants@latest to 27.1.0.

2.81.3

• Update vacuum@latest to 0.28.3.

• Update uv@latest to 0.11.18.

• Update trivy@latest to 0.71.0.

2.81.2

• Update mise@latest to 2026.5.18.

• Update cargo-semver-checks@latest to 0.48.0.

2.81.1

• Update cargo-no-dev-deps@latest to 0.2.24.

• Update cargo-hack@latest to 0.6.45.

2.81.0

• Support convco. (#1831, thanks @​graelo)

• Support docgarden (#1830, thanks @​jesse-black)

• Update vacuum@latest to 0.28.0.

• Update cargo-binstall@latest to 1.19.1.

2.80.0

• Support kingfisher. (#1874, thanks @​SAY-5)

2.79.15

• Update typos@latest to 1.47.0.

• Update wasm-tools@latest to 1.251.0.

• Update vacuum@latest to 0.27.2.

• Update uv@latest to 0.11.17.

• Update tombi@latest to 1.1.1.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.81.10] - 2026-06-11

• Update tombi@latest to 1.1.3.

• Update release-plz@latest to 0.3.159.

• Update cosign@latest to 3.1.1.

[2.81.9] - 2026-06-10

• Update wasm-bindgen@latest to 0.2.123.

• Update tombi@latest to 1.1.2.

• Update parse-changelog@latest to 0.6.17.

• Update just@latest to 1.52.0.

• Update gungraun-runner@latest to 0.19.2.

• Update cargo-binstall@latest to 1.20.0.

[2.81.8] - 2026-06-08

• Update vacuum@latest to 0.29.2.

• Update parse-dockerfile@latest to 0.1.7.

• Update mise@latest to 2026.6.1.

• Update cargo-shear@latest to 1.13.1.

[2.81.7] - 2026-06-06

• Update wasmtime@latest to 45.0.1.

• Update vacuum@latest to 0.29.1.

... (truncated)

Commits

• cde8c9e Release 2.81.4
• 1e4ec76 ci: Temporarily disable broken opensuse/tumbleweed test
• 2ba2a47 Update vacuum@latest to 0.28.4
• 193c1cc Update uv manifest
• cb4b3f9 Update typos@latest to 1.47.1
• b6e0809 Update syft@latest to 1.45.0
• 55ff171 Update prek manifest
• 4dea5bb Update mise manifest
• 3e82d2c Update cargo-shear manifest
• 31e07c4 Update cargo-neat@latest to 0.4.0
• Additional commits viewable in compare view

Updates docker/login-action from 4.1.0 to 4.2.0

Release notes

Sourced from docker/login-action's releases.

v4.2.0

• Bump @​actions/core from 3.0.0 to 3.0.1 in docker/login-action#976
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1050.0 in docker/login-action#960
• Bump @​docker/actions-toolkit from 0.86.0 to 0.90.0 in docker/login-action#970
• Bump brace-expansion from 2.0.1 to 5.0.6 in docker/login-action#993
• Bump fast-xml-builder from 1.1.4 to 1.2.0 in docker/login-action#985
• Bump fast-xml-parser from 5.3.6 to 5.8.0 in docker/login-action#963
• Bump http-proxy-agent and https-proxy-agent to 9.0.0 in docker/login-action#961
• Bump postcss from 8.5.6 to 8.5.10 in docker/login-action#979
• Bump tar from 6.2.1 to 7.5.15 in docker/login-action#991
• Bump vite from 7.3.1 to 7.3.3 in docker/login-action#986

Full Changelog: docker/login-action@v4.1.0...v4.2.0

Commits

• 650006c Merge pull request #960 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
• 99df1a3 chore: update generated content
• 3ab375f build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
• 39d8580 Merge pull request #970 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 4eefcd3 chore: update generated content
• 56d092c build(deps): bump @​docker/actions-toolkit from 0.86.0 to 0.90.0
• e2e31ca Merge pull request #976 from docker/dependabot/npm_and_yarn/actions/core-3.0.1
• 0bced94 chore: update generated content
• 3e75a0f build(deps): bump @​actions/core from 3.0.0 to 3.0.1
• 365bebd Merge pull request #984 from docker/dependabot/github_actions/aws-actions/con...
• Additional commits viewable in compare view

Updates docker/metadata-action from 6.0.0 to 6.1.0

Release notes

Sourced from docker/metadata-action's releases.

v6.1.0

• Bump @​docker/actions-toolkit from 0.79.0 to 0.90.0 in docker/metadata-action#613
• Bump brace-expansion from 1.1.12 to 5.0.6 in docker/metadata-action#658 docker/metadata-action#630
• Bump csv-parse from 6.1.0 to 6.2.1 in docker/metadata-action#617
• Bump fast-xml-parser from 5.4.2 to 5.8.0 in docker/metadata-action#620
• Bump flatted from 3.3.3 to 3.4.2 in docker/metadata-action#623
• Bump glob from 10.3.15 to 10.5.0 in docker/metadata-action#621
• Bump handlebars from 4.7.8 to 4.7.9 in docker/metadata-action#629
• Bump lodash from 4.17.23 to 4.18.1 in docker/metadata-action#639
• Bump moment-timezone from 0.6.0 to 0.6.1 in docker/metadata-action#619
• Bump picomatch from 4.0.3 to 4.0.4 in docker/metadata-action#626
• Bump postcss from 8.5.6 to 8.5.10 in docker/metadata-action#649
• Bump tar from 6.2.1 to 7.5.15 in docker/metadata-action#657
• Bump undici from 6.23.0 to 6.25.0 in docker/metadata-action#614
• Bump vite from 7.3.1 to 7.3.2 in docker/metadata-action#637

Full Changelog: docker/metadata-action@v6.0.0...v6.1.0

Commits

• 80c7e94 Merge pull request #613 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 8e0ddab chore: update generated content
• a8db14b chore(deps): Bump @​docker/actions-toolkit from 0.79.0 to 0.90.0
• 63a7371 Merge pull request #617 from docker/dependabot/npm_and_yarn/csv-parse-6.2.0
• c6916a6 chore: update generated content
• aca9205 chore(deps): Bump csv-parse from 6.1.0 to 6.2.1
• 9dcfe60 Merge pull request #629 from docker/dependabot/npm_and_yarn/handlebars-4.7.9
• 43dea76 chore: update generated content
• 7a56f5a chore(deps): Bump handlebars from 4.7.8 to 4.7.9
• e49e0aa Merge pull request #658 from docker/dependabot/npm_and_yarn/brace-expansion-5...
• Additional commits viewable in compare view

Updates depot/build-push-action from 1.17.0 to 1.18.0

Release notes

Sourced from depot/build-push-action's releases.

v1.18.0

What's Changed

• Upgrade action runtime to Node 24 (#48) @​Akatama
• Add Depot Registry save example (#47) @​maschwenk

Commits

• 98e78ad Merge pull request #48 from depot/upgrade-node-24-runtime
• e97ebff Remove Node 24 compatibility docs
• 2db929f Upgrade action runtime to Node 24
• f78af82 Merge pull request #47 from maschwenk/maschwenk/add-depot-registry-example
• 6855818 Update action.yml
• b984f6a Clarify save/save-tag/save-tags input descriptions
• 1a34abd Add Depot Registry save example
• See full diff in compare view

Updates mikepenz/release-changelog-builder-action from 6.2.1 to 6.2.2

Release notes

Sourced from mikepenz/release-changelog-builder-action's releases.

v6.2.2

🐛 Fixes

• fix: preserve $-escape sequences and backticks in placeholder values
  • PR: #1572

💬 Other

• ci: allow commit-dist to run for renovate-mike bot
  • PR: #1560

📦 Dependencies

• chore(deps): update devdependency non-major updates
  • PR: #1557
• chore(deps): update dependency undici to v8
  • PR: #1558
• fix(deps): update dependency https-proxy-agent to v9
  • PR: #1559
• chore(deps): update devdependency non-major updates
  • PR: #1563
• fix(deps): update dependency @​actions/github to v9.1.0
  • PR: #1564
• chore(deps): update dependency vite to v8.0.8
  • PR: #1562
• chore(deps): update dependency undici to v8.0.3
  • PR: #1561
• chore(deps): update devdependency non-major updates
  • PR: #1566
• chore(deps): update mcr.microsoft.com/devcontainers/typescript-node:24-bullseye docker digest to 147a65f
  • PR: #1565
• chore(deps): update dependency undici to v8.1.0
  • PR: #1568
• chore(deps): lock file maintenance
  • PR: #1581
• chore(deps): update node devdependency non-major updates
  • PR: #1580
• fix(deps): update dependency @​actions/github to v9.1.1
  • PR: #1579
• fix(deps): update dependency @​actions/core to v3.0.1
  • PR: #1578
• chore(deps): update dependency vite to v8.0.9
  • PR: #1577
• chore(deps): update mikepenz/action-gh-release action to v3
  • PR: #1588
• chore(deps): lock file maintenance
  • PR: #1589
• chore(deps): update dependency vite to v8.0.11
  • PR: #1587

... (truncated)

Commits

• 348e88f Merge pull request #1590 from mikepenz/develop
• 9816d6c chore: recompile dist
• d9e4ec1 Merge pull request #1587 from mikepenz/renovate/vite-8.x
• 393b7ac chore(deps): lock file maintenance (#1589)
• b8176fa chore(deps): update mikepenz/action-gh-release action to v3 (#1588)
• 5d9a567 chore(deps): update dependency vite to v8.0.11
• b51ce95 Merge pull request #1586 from mikepenz/chore/pin-actions
• 1f6fce9 chore(ci): pin GitHub Actions to specific versions
• 9c3faaf Merge pull request #1577 from mikepenz/renovate/vite-8.x
• 0cd8201 Merge pull request #1578 from mikepenz/renovate/actions-core-3.x
• Additional commits viewable in compare view

Updates actions/stale from 10.2.0 to 10.3.0

Release notes

Sourced from actions/stale's releases.

v10.3.0

What's Changed

Bug Fix

• Enhancement: ignore stale labeling events by @​shamoon in actions/stale#1311

Dependency Updates

• Upgrade dependencies (@​actions/core, @​octokit/plugin-retry, @​typescript-eslint) by @​Copilot in actions/stale#1335

New Contributors

• @​shamoon made their first contribution in actions/stale#1311

Full Changelog: actions/stale@v10...v10.3.0

Commits

• eb5cf3a chore: upgrade dependencies and bump version to 10.3.0 (#1335)
• db5d06a Enhancement: ignore stale labeling events (#1311)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
next	Ready	Preview, Comment	Jun 11, 2026 3:29am
react	Ready	Preview, Comment	Jun 11, 2026 3:29am

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
🔚	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[dependabot]

The group that created this PR has been removed from your configuration.