Update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
WyriHaximus/github-action-get-previous-tag	action	minor	v2.0.0 → v2.1.0
cbrgm/mastodon-github-action	action	patch	v2.2.3 → v2.2.4
github/codeql-action	action	minor	v4.37.7 → v4.38.0
metcalfc/changelog-generator	action	minor	v4.8.0 → v4.9.1
softprops/action-gh-release	action	patch	v3.0.2 → v3.0.3
step-security/harden-runner	action	patch	v2.21.0 → v2.21.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

WyriHaximus/github-action-get-previous-tag (WyriHaximus/github-action-get-previous-tag)

v2.1.0

Compare Source

v2.1.0

• Total issues resolved: 1
• Total pull requests resolved: 9
• Total contributors: 3

Bug 🐞

• 85: Replace therussiankid92/gat with nick-fields/assert-action as the… thanks to @​WyriHaximus
• 84: Fix 1.4 tag test thanks to @​WyriHaximus
• 83: Error out when fallingback to fallback but not fallback is available thanks to @​WyriHaximus
• 81: Action succeeds without finding a tag thanks to @​RemiBardon

Dependencies 📦

• 92: Pin WyriHaximus/github-workflows release management to v1.0.1. thanks to @​WyriHaximus
• 89: Update actions/checkout action to v7.0.1 thanks to @​renovate-runner[bot]
• 88: chore(deps): update nick-fields/assert-action action to v4 thanks to @​renovate-runner[bot]
• 82: chore(deps): update actions/checkout action to v7 thanks to @​renovate-runner[bot]
• 80: chore(deps): update actions/checkout action to v6.0.3 thanks to @​renovate-runner[bot]

Enhancement ✨

• 91: Replace therussiankid92/gat with nick-fields/assert-action. thanks to @​WyriHaximus

cbrgm/mastodon-github-action (cbrgm/mastodon-github-action)

v2.2.4

Compare Source

Miscellaneous Tasks

• (deps) Update go module directive to v1.26.5 by @​renovate[bot] in #​243
• (deps) Update dependency golang to v1.26.6 by @​renovate[bot] in #​245
• (tools) Update docker/setup-buildx-action action to v4.3.0 by @​renovate[bot] in #​247
• Update golangci-lint to v2.13.1 by @​cbrgm in #​248
• Add git-cliff to generate the release changelog by @​cbrgm in #​249
• (git-cliff) Display commit sha next to changelog items by @​cbrgm in #​250

Full Changelog: cbrgm/mastodon-github-action@v2.2.3...v2.2.4

github/codeql-action (github/codeql-action)

v4.38.0

Compare Source

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #​4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #​4072
• Update default CodeQL bundle version to 2.27.0. #​4129

v4.37.9

Compare Source

• Update default CodeQL bundle version to 2.26.4. #​4106

v4.37.8

Compare Source

No user facing changes.

metcalfc/changelog-generator (metcalfc/changelog-generator)

v4.9.1

Compare Source

Patch release for the v4 line

Documentation and CI only. dist/ is byte-identical to
v4.9.0,
so there is no functional change for consumers; this release exists so the v4
tag points at a commit whose docs are correct.

• Return the modified changelog as a real multiline output (#​478)

The README's "Simple output modifications" recipe percent-encoded newlines as
%0A, which the long-removed ::set-output command decoded. $GITHUB_OUTPUT
does not, so anyone who copied that snippet got a single line with literal
%0A in it. It now uses the heredoc form, with a random delimiter because the
value is built from commit subjects.

The changelog output format remains unchanged from v4.8.0. See
v5.0.0
for the breaking change that renders commit subjects as literal text.

v4.9.0

Compare Source

Maintenance release for the v4 line

Security and dependency fixes only. The changelog output format is unchanged
from v4.8.0 -- verified byte-identical -- so tracking @v4 is safe.

• undici 7.29.0, closing all 12 open advisories (4 high)
• release-workflow hardening: tag names no longer reach a shell as source, and
  the published bundle is now verified against a rebuild before attestation
• @vercel/ncc 0.45.0 and dev-dependency bumps

v5.0.0
contains these same fixes plus a breaking change: commit subjects render as
literal text, so a merged pull request's subject can no longer inject links or
mentions into your release notes. That change also stops #123 autolinking
inside subjects, which is why it is not on the v4 line.

---

• 8b3d973 - 4.9.0
• ab3e266 - fix: carry the bump:workflow provenance fix onto the v4 line
• f6a78ba - release: prepare the v4 maintenance line
• 8becfce - fix(deps): bound the dependency overrides and clear the undici advisories (#​476)
• f723555 - build(deps-dev): bump @​vercel/ncc from 0.44.1 to 0.45.0 (#​470)
• 88097f8 - build(deps-dev): bump eslint from 10.8.1 to 10.9.0 (#​472)
• 430ccb9 - build(deps-dev): bump globals from 17.9.0 to 17.11.0 (#​471)
• d40422b - build(deps): bump the codeql-action group with 3 updates (#​469)
• ba35f7d - Verify release bundle before attestation (#​474)
• 91ac6bb - Render changelog subjects as literal text (#​475)
• c2ec39e - Keep release tag names out of shell source (#​473)
• b28b10d - ci: let the stale workflow be run on demand (#​467)
• d255efb - build(deps): bump actions/setup-node from 6.5.0 to 7.0.0 (#​463)
• 20397cc - build(deps): bump actions/checkout from 6.0.2 to 7.0.1 (#​450)
• 67da1d3 - build(deps): bump actions/stale from 10.2.0 to 11.0.0 (#​462)

softprops/action-gh-release (softprops/action-gh-release)

v3.0.3

Compare Source

3.0.3 is a maintenance release with updated dependencies. It also safely
classifies malformed GitHub API errors to avoid secondary failures (#​822).

What's Changed

Bug fixes 🐛

• fix: safely classify GitHub API errors by @​chenrui333 in #​822

Other Changes 🔄

• dependency updates

step-security/harden-runner (step-security/harden-runner)

v2.21.1

Compare Source

What's Changed

• Improved performance of the disable-sudo feature.
• Fixed an issue in the Community tier where new endpoints required by the GitHub Actions runner were not being implicitly allowed in block mode.
• Fixed the Harden-Runner post step failing on Linux distributions that do not have a merged /usr filesystem layout (for example Debian 11), where /usr/bin/echo does not exist. This mainly affected self-hosted runners.
• Documentation updates: clarified which features are in the Community (free) vs Enterprise tier.

Full Changelog: step-security/harden-runner@v2.21.0...v2.21.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.