chore: update all dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
github/codeql-action	action	patch	v4.35.1 → v4.35.2
step-security/action-semantic-pull-request	action	patch	v6.1.1 → v6.1.2
step-security/harden-runner	action	minor	v2.17.0 → v2.18.0	v2.19.0

---

Release Notes

github/codeql-action (github/codeql-action)

v4.35.2

Compare Source

• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #​3795
• The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #​3789
• Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #​3794
• Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #​3807
• Update default CodeQL bundle version to 2.25.2. #​3823

step-security/action-semantic-pull-request (step-security/action-semantic-pull-request)

v6.1.2

Compare Source

What's Changed

• build(deps): bump js-yaml from 4.1.0 to 4.1.1 by @​dependabot[bot] in #​147
• ci: update audit_package.yml by @​Raj-StepSecurity in #​149
• fix: Security updates by @​github-actions[bot] in #​150
• ci: Update audit_package.yml by @​Raj-StepSecurity in #​151
• fix: build(deps): bump axios from 1.12.2 to 1.13.5 by @​dependabot[bot] in #​152
• fix: upgrade packages and fix vulnerabilities by @​Raj-StepSecurity in #​153
• ci: Update audit_package.yml by @​Raj-StepSecurity in #​154
• ci: Update audit_package.yml by @​Raj-StepSecurity in #​155
• fix: Security updates by @​github-actions[bot] in #​156
• fix: Security updates by @​github-actions[bot] in #​157
• fix: upgrade packages to fix vulnerabilities by @​Raj-StepSecurity in #​158
• ci: made node version input to default at 24 by @​amanstep in #​133
• fix: Security updates by @​github-actions[bot] in #​159
• feat: added banner and update subscription check to make maintained actions free for public repos by @​Raj-StepSecurity in #​160
• fix: Security updates by @​github-actions[bot] in #​161
• ci: update actions_release.yml by @​Raj-StepSecurity in #​162

Full Changelog: step-security/action-semantic-pull-request@v6...v6.1.2

step-security/harden-runner (step-security/harden-runner)

v2.18.0

Compare Source

What's Changed

Global Block List: During supply chain incidents like the recent axios and trivy compromises, StepSecurity will add known malicious domains and IP addresses (IOCs) to a global block list. These will be automatically blocked, even in audit mode, providing immediate protection without requiring any workflow changes.

Deploy on Self-Hosted VM: Added deploy-on-self-hosted-vm input that allows the Harden Runner agent to be installed directly on ephemeral self-hosted Linux runner VMs at workflow runtime. This is intended as an alternative when baking the agent into the VM image is not possible.

Full Changelog: step-security/harden-runner@v2.17.0...v2.18.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 4am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.