chore(deps): update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	patch	v4.1.1 -> v4.1.4
actions/dependency-review-action	action	minor	v4.2.5 -> v4.3.2
actions/download-artifact	action	patch	v4.1.4 -> v4.1.7
actions/setup-go	action	patch	v5.0.0 -> v5.0.1
actions/upload-artifact	action	patch	v4.3.1 -> v4.3.3
actionsdesk/lfs-warning	action	minor	v3.2 -> v3.3
github/codeql-action	action	minor	v3.24.9 -> v3.25.3
slsa-framework/slsa-verifier	action	minor	v2.4.1 -> v2.5.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/checkout (actions/checkout)

v4.1.4

Compare Source

• Disable extensions.worktreeConfig when disabling sparse-checkout by @​jww3 in https://github.com/actions/checkout/pull/1692
• Add dependabot config by @​cory-miller in https://github.com/actions/checkout/pull/1688
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot in https://github.com/actions/checkout/pull/1693
• Bump word-wrap from 1.2.3 to 1.2.5 by @​dependabot in https://github.com/actions/checkout/pull/1643

v4.1.3

Compare Source

What's Changed

• Update actions/checkout version in update-main-version.yml by @​jww3 in https://github.com/actions/checkout/pull/1650
• Check git version before attempting to disable sparse-checkout by @​jww3 in https://github.com/actions/checkout/pull/1656
• Add SSH user parameter by @​cory-miller in https://github.com/actions/checkout/pull/1685

Full Changelog: actions/checkout@v4.1.2...v4.1.3

v4.1.2

Compare Source

• Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in https://github.com/actions/checkout/pull/1598

actions/dependency-review-action (actions/dependency-review-action)

v4.3.2

Compare Source

What's Changed

• Fix package-url parsing for allow-dependencies-licenses by @​juxtin in https://github.com/actions/dependency-review-action/pull/761

Full Changelog: actions/dependency-review-action@v4.3.1...v4.3.2

v4.3.1

Compare Source

What's Changed

This release fixes some bugs related to package-url parsing that were introduced in 4.3.0. See https://github.com/actions/dependency-review-action/pull/753.

Full Changelog: actions/dependency-review-action@V4.3.0...v4.3.1

v4.3.0

Compare Source

New Features

• The deny-packages option can now be used without a version number to exclude all versions of a package.

What's Changed

• Fix action variable name for scorecard by @​lukehinds in https://github.com/actions/dependency-review-action/pull/735
• Fix extra https:// in summary by @​jhutchings1 in https://github.com/actions/dependency-review-action/pull/748
• Bump typescript from 5.3.3 to 5.4.5 by @​dependabot in https://github.com/actions/dependency-review-action/pull/744
• Bump eslint-plugin-github from 4.10.1 to 4.10.2 by @​dependabot in https://github.com/actions/dependency-review-action/pull/737
• Show denied packages with red X by @​juxtin in https://github.com/actions/dependency-review-action/pull/750
• deny-packages configuration option can deny specified version or all packages by @​febuiles and @​bteng22 in https://github.com/actions/dependency-review-action/pull/733

New Contributors

• @​bteng22 made their first contribution in https://github.com/actions/dependency-review-action/pull/733
• @​lukehinds made their first contribution in https://github.com/actions/dependency-review-action/pull/735

Full Changelog: actions/dependency-review-action@v4.2.5...V4.3.0

actions/download-artifact (actions/download-artifact)

v4.1.7

Compare Source

What's Changed

• Update @​actions/artifact dependency by @​bethanyj28 in https://github.com/actions/download-artifact/pull/325

Full Changelog: actions/download-artifact@v4.1.6...v4.1.7

v4.1.6

Compare Source

What's Changed

• updating @actions/artifact dependency to v2.1.6 by @​eggyhead in https://github.com/actions/download-artifact/pull/324

Full Changelog: actions/download-artifact@v4.1.5...v4.1.6

v4.1.5

Compare Source

What's Changed

• Update readme with v3/v2/v1 deprecation notice by @​robherley in https://github.com/actions/download-artifact/pull/322
• Update dependencies @actions/core to v1.10.1 and @actions/artifact to v2.1.5

Full Changelog: actions/download-artifact@v4.1.4...v4.1.5

actions/setup-go (actions/setup-go)

v5.0.1

Compare Source

What's Changed

• Bump undici from 5.28.2 to 5.28.3 and dependencies upgrade by @​dependabot , @​HarithaVattikuti in https://github.com/actions/setup-go/pull/465
• Update documentation with latest V5 release notes by @​ab in https://github.com/actions/setup-go/pull/459
• Update version documentation by @​178inaba in https://github.com/actions/setup-go/pull/458
• Documentation update of actions/setup-go to v5 by @​chenrui333 in https://github.com/actions/setup-go/pull/449

New Contributors

• @​ab made their first contribution in https://github.com/actions/setup-go/pull/459

Full Changelog: actions/setup-go@v5.0.0...v5.0.1

actions/upload-artifact (actions/upload-artifact)

v4.3.3

Compare Source

What's Changed

• updating @actions/artifact dependency to v2.1.6 by @​eggyhead in https://github.com/actions/upload-artifact/pull/565

Full Changelog: actions/upload-artifact@v4.3.2...v4.3.3

v4.3.2

Compare Source

What's Changed

• Update release-new-action-version.yml by @​konradpabjan in https://github.com/actions/upload-artifact/pull/516
• Minor fix to the migration readme by @​andrewakim in https://github.com/actions/upload-artifact/pull/523
• Update readme with v3/v2/v1 deprecation notice by @​robherley in https://github.com/actions/upload-artifact/pull/561
• updating @actions/artifact dependency to v2.1.5 and @actions/core to v1.0.1 by @​eggyhead in https://github.com/actions/upload-artifact/pull/562

New Contributors

• @​andrewakim made their first contribution in https://github.com/actions/upload-artifact/pull/523

Full Changelog: actions/upload-artifact@v4.3.1...v4.3.2

actionsdesk/lfs-warning (actionsdesk/lfs-warning)

v3.3

Compare Source

What's Changed

• update node js to 16 by @​GlazerMann in https://github.com/ppremk/lfs-warning/pull/148
• Fixing README to match repo move by @​samthebest in https://github.com/ppremk/lfs-warning/pull/153
• Update CODEOWNERS by @​rajbos in https://github.com/ppremk/lfs-warning/pull/158
• Bump http-cache-semantics from 4.1.0 to 4.1.1 by @​dependabot in https://github.com/ppremk/lfs-warning/pull/151
• Bump @​babel/traverse from 7.15.4 to 7.23.4 by @​dependabot in https://github.com/ppremk/lfs-warning/pull/159
• Bump tough-cookie from 4.0.0 to 4.1.3 by @​dependabot in https://github.com/ppremk/lfs-warning/pull/160
• Bump cacheable-request and gts by @​dependabot in https://github.com/ppremk/lfs-warning/pull/152
• Update emoji and convert file list to markdown list by @​rajbos in https://github.com/ppremk/lfs-warning/pull/161
• Bump got and gts by @​dependabot in https://github.com/ppremk/lfs-warning/pull/155
• Exclude files without blob_url when getting PR blobs by @​rajbos in https://github.com/ppremk/lfs-warning/pull/162
• Support pull_request_target by @​rajbos in https://github.com/ppremk/lfs-warning/pull/164
• Update-node by @​rajbos in https://github.com/ppremk/lfs-warning/pull/163
• Fix text setup for the issue comment by @​rajbos in https://github.com/ppremk/lfs-warning/pull/166
• Validate PR changes to make sure there are no changes missing by @​rajbos in https://github.com/ppremk/lfs-warning/pull/165
• Fix emoji by @​rajbos in https://github.com/ppremk/lfs-warning/pull/167
• Bump undici from 5.28.2 to 5.28.4 by @​dependabot in https://github.com/ppremk/lfs-warning/pull/171

New Contributors

• @​GlazerMann made their first contribution in https://github.com/ppremk/lfs-warning/pull/148
• @​samthebest made their first contribution in https://github.com/ppremk/lfs-warning/pull/153
• @​rajbos made their first contribution in https://github.com/ppremk/lfs-warning/pull/158

Full Changelog: ppremk/lfs-warning@v3.2...v3.3

github/codeql-action (github/codeql-action)

v3.25.3

Compare Source

v3.25.2

Compare Source

v3.25.1

Compare Source

v3.25.0

Compare Source

v3.24.10

Compare Source

slsa-framework/slsa-verifier (slsa-framework/slsa-verifier)

v2.5.1

Compare Source

What's Changed

• feat: Add cosign registry opts for provenance registry by @​saisatishkarra in https://github.com/slsa-framework/slsa-verifier/pull/729 and https://github.com/slsa-framework/slsa-verifier/pull/736
• feat: Add support for DSSE Rekor type by @​haydentherapper in https://github.com/slsa-framework/slsa-verifier/pull/742

New Contributors

• @​saisatishkarra made their first contribution in https://github.com/slsa-framework/slsa-verifier/pull/729
• @​ramonpetgrave64 made their first contribution in https://github.com/slsa-framework/slsa-verifier/pull/737
• @​haydentherapper made their first contribution in https://github.com/slsa-framework/slsa-verifier/pull/742

Full Changelog: slsa-framework/slsa-verifier@v2.4.1...v2.5.1

---

Configuration

📅 Schedule: Branch creation - "before 4am on the first day of the month" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[renovate]

⚠ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: .github/workflows/pre-submit.lfs.yml

Post-upgrade command '(cd ./actions/installer && make clean && make package)' has not been added to the allowed list in allowedPostUpgradeCommands

File name: .github/workflows/scorecards.yml

Post-upgrade command '(cd ./actions/installer && make clean && make package)' has not been added to the allowed list in allowedPostUpgradeCommands

File name: .github/workflows/codeql-analysis.yml

Post-upgrade command '(cd ./actions/installer && make clean && make package)' has not been added to the allowed list in allowedPostUpgradeCommands

File name: .github/workflows/codeql-analysis.yml

Post-upgrade command '(cd ./actions/installer && make clean && make package)' has not been added to the allowed list in allowedPostUpgradeCommands

File name: .github/workflows/codeql-analysis.yml

Post-upgrade command '(cd ./actions/installer && make clean && make package)' has not been added to the allowed list in allowedPostUpgradeCommands

File name: .github/workflows/release.yml

Post-upgrade command '(cd ./actions/installer && make clean && make package)' has not been added to the allowed list in allowedPostUpgradeCommands