chore(deps): update all-ci-updates by renovate[bot] · Pull Request #1902 · projectcapsule/capsule

renovate · 2026-04-21T17:00:19Z

This PR contains the following updates:

Package	Type	Update	Change	Pending
aquasecurity/trivy-action	action	minor	`0.35.0` → `v0.36.0`
argo-cd		patch	`9.5.2` → `9.5.15`	`9.5.19` (+3)
codecov/codecov-action	action	patch	`v6.0.0` → `v6.0.1`
github/codeql-action	action	patch	`v4.35.2` → `v4.35.5`	`v4.36.2` (+2)
goreleaser/goreleaser-action	action	minor	`v7.1.0` → `v7.2.2`
kube-prometheus-stack (source)		minor	`85.1.3` → `85.2.1`	`85.4.0` (+5)
securego/gosec	action	minor	`v2.25.0` → `v2.26.1`	`v2.27.1` (+1)

Release Notes

aquasecurity/trivy-action (aquasecurity/trivy-action)

`v0.36.0`

Compare Source

What's Changed

chore(ci): update bump-trivy workflow by @DmitriyLewen in #546
ci: use action.yaml as single source of truth for Trivy version by @nikpivkin in #552
ci: replace peter-evans/create-pull-request with gh CLI by @nikpivkin in #550
test: use pinned digests for trivy-db, trivy-java-db and trivy-checks by @nikpivkin in #555
ci: add dependabot config by @nikpivkin in #556
chore: add zizmor config by @nikpivkin in #557
chore(deps): bump the actions group with 5 updates by @dependabot[bot] in #558
fix: use portable shebang in entrypoint.sh by @Hayao0819 in #545
Fix typo in GOOGLE_APPLICATION_CREDENTIALS env var name by @patrik-csak in #547
Upgrade Trivy action version from 0.33.1 to 0.35.0 fixes #549 by @Aditya09-cse in #548
chore: use GitHub Actions as git commit author in bump-trivy workflow by @nikpivkin in #561
chore(deps): Update trivy to v0.70.0 by @Argon-DevOps-Mgt in #559
chore: update action version to v0.36.0 in examples by @nikpivkin in #563

New Contributors

@dependabot[bot] made their first contribution in #558
@Hayao0819 made their first contribution in #545
@patrik-csak made their first contribution in #547
@Aditya09-cse made their first contribution in #548
@Argon-DevOps-Mgt made their first contribution in #559

Full Changelog: aquasecurity/trivy-action@v0.35.0...v0.36.0

argoproj/argo-helm (argo-cd)

`v9.5.15`

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

chore(argo-cd): Update ghcr.io/oliver006/redis_exporter Docker tag to v1.84.0 by @argoproj-renovate[bot] in #3901

Full Changelog: argoproj/argo-helm@argocd-image-updater-1.2.1...argo-cd-9.5.15

`v9.5.14`

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

chore(deps): bump the dependencies group with 3 updates by @dependabot[bot] in #3881
chore(deps): update renovatebot/github-action action to v46.1.14 by @argoproj-renovate[bot] in #3883
chore(argo-cd): Update dependency argoproj/argo-cd to v3.4.2 by @argoproj-renovate[bot] in #3890

Full Changelog: argoproj/argo-helm@argo-cd-9.5.13...argo-cd-9.5.14

`v9.5.13`

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

fix(github): drop workflows by @jmeridth in #3879
feat(argo-cd): support tpl in env var values by @DrFaust92 in #3842

Full Changelog: argoproj/argo-helm@argo-cd-9.5.12...argo-cd-9.5.13

`v9.5.12`

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

chore(deps): update ghcr.io/renovatebot/renovate docker tag to v43.160.4 by @argoproj-renovate[bot] in #3868
chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 in the dependencies group by @dependabot[bot] in #3870
chore(deps): update renovatebot/github-action action to v46.1.13 by @argoproj-renovate[bot] in #3872
chore(argo-cd): Update dependency argoproj/argo-cd to v3.4.1 by @argoproj-renovate[bot] in #3876

Full Changelog: argoproj/argo-helm@argo-cd-9.5.11...argo-cd-9.5.12

`v9.5.11`

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

chore(argo-cd): Update dependency argoproj/argo-cd to v3.3.9 by @argoproj-renovate[bot] in #3867

Full Changelog: argoproj/argo-helm@argo-cd-9.5.10...argo-cd-9.5.11

`v9.5.10`

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

chore(deps): bump step-security/harden-runner from 2.16.0 to 2.19.0 in the dependencies group across 1 directory by @dependabot[bot] in #3850
chore(argo-cd): Update ghcr.io/oliver006/redis_exporter Docker tag to v1.83.0 by @argoproj-renovate[bot] in #3866

Full Changelog: argoproj/argo-helm@argo-cd-9.5.9...argo-cd-9.5.10

`v9.5.9`

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

fix(argo-cd): fixed service port issue with applicationset webhook httproute by @dromadaire54 in #3862

Full Changelog: argoproj/argo-helm@argo-cd-9.5.8...argo-cd-9.5.9

`v9.5.8`

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

chore(deps): update renovatebot/github-action action to v46.1.12 by @argoproj-renovate[bot] in #3861
fix(argo-cd): support empty matches in GRPCRoute and HTTPRoute rules by @yurrriq in #3604

Full Changelog: argoproj/argo-helm@argo-cd-9.5.7...argo-cd-9.5.8

`v9.5.7`

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

feat(argo-cd): Make PrometheusRule API version field overridable like it is in ServiceMonitor manifests. by @rurod in #3857

New Contributors

@rurod made their first contribution in #3857

Full Changelog: argoproj/argo-helm@argo-cd-9.5.6...argo-cd-9.5.7

`v9.5.6`

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

feat(argo-cd): adding httproute support to applicationset webhook by @dromadaire54 in #3859

New Contributors

@dromadaire54 made their first contribution in #3859

Full Changelog: argoproj/argo-helm@argo-cd-9.5.5...argo-cd-9.5.6

`v9.5.5`

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

ci(github): add draft PR lifecycle workflows by @jmeridth in #3794
fix(github): skip draft lifecycle workflows for bot-authored PRs by @jmeridth in #3851
fix(github): correct renovate bot actor name in draft lifecycle workflows by @jmeridth in #3855
chore(deps): update renovatebot/github-action action to v46.1.11 by @argoproj-renovate[bot] in #3854
fix(argo-cd): fix ArgoAppNotSynced PrometheusRule annotation template syntax by @vrivellino in #3853

New Contributors

@vrivellino made their first contribution in #3853

Full Changelog: argoproj/argo-helm@argo-workflows-1.0.13...argo-cd-9.5.5

`v9.5.4`

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

chore(argo-cd): Change order of source URL by @nebula-it in #3837

New Contributors

@nebula-it made their first contribution in #3837

Full Changelog: argoproj/argo-helm@argo-cd-9.5.3...argo-cd-9.5.4

`v9.5.3`

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

chore(deps): bump the dependencies group with 2 updates by @dependabot[bot] in #3838
chore(deps): update renovatebot/github-action action to v46.1.10 by @argoproj-renovate[bot] in #3839
chore(argo-cd): Update dependency argoproj/argo-cd to v3.3.8 by @argoproj-renovate[bot] in #3841

Full Changelog: argoproj/argo-helm@argo-cd-9.5.2...argo-cd-9.5.3

codecov/codecov-action (codecov/codecov-action)

`v6.0.1`

Compare Source

What's Changed

fix: prevent template injection in run: steps (VULN-1652) by @thomasrockhu-codecov in #1947
chore(release): 6.0.1 by @thomasrockhu-codecov in #1949

Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1

github/codeql-action (github/codeql-action)

`v4.35.5`

Compare Source

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

`v4.35.4`

Compare Source

Update default CodeQL bundle version to 2.25.4. #3881

`v4.35.3`

Compare Source

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
Update default CodeQL bundle version to 2.25.3. #3865

goreleaser/goreleaser-action (goreleaser/goreleaser-action)

`v7.2.2`

Compare Source

What's Changed

ci(deps): bump the actions group with 3 updates by @dependabot[bot] in #560
fix: nightly resolution to select newest published release by @Copilot in #562

New Contributors

@Copilot made their first contribution in #562

Full Changelog: goreleaser/goreleaser-action@v7...v7.2.2

`v7.2.1`

Compare Source

This fully removes the usage of the old nightly moving tag.

Full Changelog: goreleaser/goreleaser-action@v7.2.0...v7.2.1

`v7.2.0`

Compare Source

What's Changed

test: cover install across release eras by @caarlos0 in #555
feat: add version-file input by @caarlos0 in #556
feat: resolve nightly to latest vX.Y.Z--nightly release by @caarlos0 in #558

Full Changelog: goreleaser/goreleaser-action@v7...v7.2.0

prometheus-community/helm-charts (kube-prometheus-stack)

`v85.2.1`

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

[kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @renovate[bot] in #6932

Full Changelog: prometheus-community/helm-charts@prometheus-operator-admission-webhook-0.40.1...kube-prometheus-stack-85.2.1

`v85.2.0`

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

[kube-prometheus-stack] Update https://github.com/kubernetes-monitoring/kubernetes-mixin digest to 1a2f5ad by @renovate[bot] in #6926

Full Changelog: prometheus-community/helm-charts@prometheus-nats-exporter-2.23.0...kube-prometheus-stack-85.2.0

securego/gosec (securego/gosec)

`v2.26.1`

Compare Source

Changelog

4a3bd8a Update cosign to v3.0.6 (#1659)

`v2.26.0`

Compare Source

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

codecov · 2026-04-21T17:04:51Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 10.05%. Comparing base (0edd6ac) to head (95a88ef).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1902      +/-   ##
==========================================
- Coverage   10.06%   10.05%   -0.02%     
==========================================
  Files         343      343              
  Lines       18644    18644              
==========================================
- Hits         1877     1875       -2     
- Misses      16708    16709       +1     
- Partials       59       60       +1

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copilot