chore(deps): bump the actions-weekly group across 1 directory with 9 updates

[dependabot]

Bumps the actions-weekly group with 9 updates in the / directory:

Package	From	To
actions/checkout	6	6.0.2
crate-ci/typos	1.46.1	1.47.0
github/codeql-action	4.35.4	4.36.0
taiki-e/install-action	2.77.6	2.80.0
docker/login-action	4.1.0	4.2.0
docker/metadata-action	6.0.0	6.1.0
depot/build-push-action	1.17.0	1.18.0
mikepenz/release-changelog-builder-action	6.2.1	6.2.2
actions/stale	10.2.0	10.3.0

Updates actions/checkout from 6 to 6.0.2

Release notes

Sourced from actions/checkout's releases.

v6.0.2

What's Changed

• Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @​TingluoHuang in actions/checkout#2355
• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

• Update all references from v5 and v4 to v6 by @​ericsciple in actions/checkout#2314
• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327
• Clarify v6 README by @​ericsciple in actions/checkout#2328

Full Changelog: actions/checkout@v6...v6.0.1

Commits

• 6d193bf Bump braces from 3.0.2 to 3.0.3 (#1777)
• db0cee9 Bump the minor-npm-dependencies group across 1 directory with 4 updates (#1872)
• b684943 Add Ref and Commit outputs (#1180)
• 2d7d9f7 Provide explanation for where user email came from (#1869)
• See full diff in compare view

Updates crate-ci/typos from 1.46.1 to 1.47.0

Release notes

Sourced from crate-ci/typos's releases.

v1.47.0

[1.47.0] - 2026-05-29

Features

• Updated the dictionary with the May 2026 changes

v1.46.3

[1.46.3] - 2026-05-23

Fixes

• Don't correct to sequentials
• Don't correct to subdolder

v1.46.2

[1.46.2] - 2026-05-16

Fixes

• Don't correct to criterias
• Don't correct to replaceables

Changelog

Sourced from crate-ci/typos's changelog.

Change Log

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

[Unreleased] - ReleaseDate

[1.47.2] - 2026-06-04

Fixes

• Don't correct inferrable
• Correct unused inferible variant

[1.47.1] - 2026-06-03

Fixes

• Don't correct requestors

[1.47.0] - 2026-05-29

Features

• Updated the dictionary with the May 2026 changes

[1.46.3] - 2026-05-23

Fixes

• Don't correct to sequentials
• Don't correct to subdolder

[1.46.2] - 2026-05-16

Fixes

• Don't correct to criterias
• Don't correct to replaceables

[1.46.1] - 2026-05-08

Fixes

• Don't correct to confidentials

[1.46.0] - 2026-04-30

... (truncated)

Commits

• f8a58b6 chore: Release
• 52ee9d7 chore: Release
• f1aafea docs: Update changelog
• 0d2e4af Merge pull request #1563 from epage/may
• d818ce0 feat(dict): May updates
• 547b806 chore(deps): Update Rust Stable to v1.96 (#1561)
• 7b04f66 chore: Release
• 6eefe9f docs: Update changelog
• 27ae304 Merge pull request #1559 from epage/fixes
• 5b01f66 fix(dict): Don't correct to sequentials
• Additional commits viewable in compare view

Updates github/codeql-action from 4.35.4 to 4.36.0

Release notes

Sourced from github/codeql-action's releases.

v4.36.0

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

v4.35.5

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

• Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
• Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
• Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
• Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
• Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795
• The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789
• Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794
• Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807
• Update default CodeQL bundle version to 2.25.2. #3823

... (truncated)

Commits

• 7211b7c Merge pull request #3927 from github/update-v4.36.0-ebc2d9e2b
• 7740f2f Update changelog for v4.36.0
• ebc2d9e Merge pull request #3926 from github/update-bundle/codeql-bundle-v2.25.5
• d1f74b7 Add changelog note
• 2dc40ce Update default bundle to codeql-bundle-v2.25.5
• 8449852 Merge pull request #3910 from github/henrymercer/repo-size-diff-check
• 72ac23c Update excluded required check list
• c5297a2 Merge pull request #3919 from github/henrymercer/workflow-concurrency
• 8ffeae7 CI: Automatically cancel non-generated workflows
• f3f52bf Revert getErrorMessage import
• Additional commits viewable in compare view

Updates taiki-e/install-action from 2.77.6 to 2.80.0

Release notes

Sourced from taiki-e/install-action's releases.

2.80.0

• Support kingfisher. (#1874, thanks @​SAY-5)

2.79.15

• Update typos@latest to 1.47.0.

• Update wasm-tools@latest to 1.251.0.

• Update vacuum@latest to 0.27.2.

• Update uv@latest to 0.11.17.

• Update tombi@latest to 1.1.1.

• Update mise@latest to 2026.5.16.

2.79.14

• Update vacuum@latest to 0.27.0.

• Update cargo-deny@latest to 0.19.8.

2.79.13

• Update gungraun-runner@latest to 0.19.1.

• Update biome@latest to 2.4.16.

2.79.12

• Update prek@latest to 0.4.3.

• Remove uses of crates.io API, which potentially cases 403 error.

2.79.11

• Update vacuum@latest to 0.26.8.

• Update cargo-nextest@latest to 0.9.137.

2.79.10

• Update tombi@latest to 1.1.0.

• Update prek@latest to 0.4.2.

• Update editorconfig-checker@latest to 3.7.0.

2.79.9

• Update vacuum@latest to 0.26.7.

• Update tombi@latest to 1.0.0.

2.79.8

• Update parse-dockerfile@latest to 0.1.6.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.81.6] - 2026-06-05

• Update prek@latest to 0.4.4.

• Update cargo-shear@latest to 1.13.0.

[2.81.5] - 2026-06-05

• Update vacuum@latest to 0.29.0.

• Update uv@latest to 0.11.19.

• Update typos@latest to 1.47.2.

• Update mise@latest to 2026.6.0.

[2.81.4] - 2026-06-04

• Update vacuum@latest to 0.28.4.

• Update typos@latest to 1.47.1.

• Update syft@latest to 1.45.0.

• Update cargo-neat@latest to 0.4.0.

• Update cargo-mutants@latest to 27.1.0.

[2.81.3] - 2026-06-03

• Update vacuum@latest to 0.28.3.

• Update uv@latest to 0.11.18.

• Update trivy@latest to 0.71.0.

[2.81.2] - 2026-06-02

... (truncated)

Commits

• 50b4a71 Release 2.80.0
• 20e0117 Update changelog
• e8c0411 Update readme
• d7905fc Support artifact attestations verification for kingfisher
• 7d86523 Support kingfisher (#1874)
• 3ddb2c5 Update vacuum manifest
• ae0a4b7 Update coreutils manifest
• b97c7e7 Update cargo-no-dev-deps manifest
• adaaf73 Update cargo-hack manifest
• 0fd4636 Release 2.79.15
• Additional commits viewable in compare view

Updates docker/login-action from 4.1.0 to 4.2.0

Release notes

Sourced from docker/login-action's releases.

v4.2.0

• Bump @​actions/core from 3.0.0 to 3.0.1 in docker/login-action#976
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1050.0 in docker/login-action#960
• Bump @​docker/actions-toolkit from 0.86.0 to 0.90.0 in docker/login-action#970
• Bump brace-expansion from 2.0.1 to 5.0.6 in docker/login-action#993
• Bump fast-xml-builder from 1.1.4 to 1.2.0 in docker/login-action#985
• Bump fast-xml-parser from 5.3.6 to 5.8.0 in docker/login-action#963
• Bump http-proxy-agent and https-proxy-agent to 9.0.0 in docker/login-action#961
• Bump postcss from 8.5.6 to 8.5.10 in docker/login-action#979
• Bump tar from 6.2.1 to 7.5.15 in docker/login-action#991
• Bump vite from 7.3.1 to 7.3.3 in docker/login-action#986

Full Changelog: docker/login-action@v4.1.0...v4.2.0

Commits

• 650006c Merge pull request #960 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
• 99df1a3 chore: update generated content
• 3ab375f build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
• 39d8580 Merge pull request #970 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 4eefcd3 chore: update generated content
• 56d092c build(deps): bump @​docker/actions-toolkit from 0.86.0 to 0.90.0
• e2e31ca Merge pull request #976 from docker/dependabot/npm_and_yarn/actions/core-3.0.1
• 0bced94 chore: update generated content
• 3e75a0f build(deps): bump @​actions/core from 3.0.0 to 3.0.1
• 365bebd Merge pull request #984 from docker/dependabot/github_actions/aws-actions/con...
• Additional commits viewable in compare view

Updates docker/metadata-action from 6.0.0 to 6.1.0

Release notes

Sourced from docker/metadata-action's releases.

v6.1.0

• Bump @​docker/actions-toolkit from 0.79.0 to 0.90.0 in docker/metadata-action#613
• Bump brace-expansion from 1.1.12 to 5.0.6 in docker/metadata-action#658 docker/metadata-action#630
• Bump csv-parse from 6.1.0 to 6.2.1 in docker/metadata-action#617
• Bump fast-xml-parser from 5.4.2 to 5.8.0 in docker/metadata-action#620
• Bump flatted from 3.3.3 to 3.4.2 in docker/metadata-action#623
• Bump glob from 10.3.15 to 10.5.0 in docker/metadata-action#621
• Bump handlebars from 4.7.8 to 4.7.9 in docker/metadata-action#629
• Bump lodash from 4.17.23 to 4.18.1 in docker/metadata-action#639
• Bump moment-timezone from 0.6.0 to 0.6.1 in docker/metadata-action#619
• Bump picomatch from 4.0.3 to 4.0.4 in docker/metadata-action#626
• Bump postcss from 8.5.6 to 8.5.10 in docker/metadata-action#649
• Bump tar from 6.2.1 to 7.5.15 in docker/metadata-action#657
• Bump undici from 6.23.0 to 6.25.0 in docker/metadata-action#614
• Bump vite from 7.3.1 to 7.3.2 in docker/metadata-action#637

Full Changelog: docker/metadata-action@v6.0.0...v6.1.0

Commits

• 80c7e94 Merge pull request #613 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 8e0ddab chore: update generated content
• a8db14b chore(deps): Bump @​docker/actions-toolkit from 0.79.0 to 0.90.0
• 63a7371 Merge pull request #617 from docker/dependabot/npm_and_yarn/csv-parse-6.2.0
• c6916a6 chore: update generated content
• aca9205 chore(deps): Bump csv-parse from 6.1.0 to 6.2.1
• 9dcfe60 Merge pull request #629 from docker/dependabot/npm_and_yarn/handlebars-4.7.9
• 43dea76 chore: update generated content
• 7a56f5a chore(deps): Bump handlebars from 4.7.8 to 4.7.9
• e49e0aa Merge pull request #658 from docker/dependabot/npm_and_yarn/brace-expansion-5...
• Additional commits viewable in compare view

Updates depot/build-push-action from 1.17.0 to 1.18.0

Release notes

Sourced from depot/build-push-action's releases.

v1.18.0

What's Changed

• Upgrade action runtime to Node 24 (#48) @​Akatama
• Add Depot Registry save example (#47) @​maschwenk

Commits

• 98e78ad Merge pull request #48 from depot/upgrade-node-24-runtime
• e97ebff Remove Node 24 compatibility docs
• 2db929f Upgrade action runtime to Node 24
• f78af82 Merge pull request #47 from maschwenk/maschwenk/add-depot-registry-example
• 6855818 Update action.yml
• b984f6a Clarify save/save-tag/save-tags input descriptions
• 1a34abd Add Depot Registry save example
• See full diff in compare view

Updates mikepenz/release-changelog-builder-action from 6.2.1 to 6.2.2

Release notes

Sourced from mikepenz/release-changelog-builder-action's releases.

v6.2.2

🐛 Fixes

• fix: preserve $-escape sequences and backticks in placeholder values
  • PR: #1572

💬 Other

• ci: allow commit-dist to run for renovate-mike bot
  • PR: #1560

📦 Dependencies

• chore(deps): update devdependency non-major updates
  • PR: #1557
• chore(deps): update dependency undici to v8
  • PR: #1558
• fix(deps): update dependency https-proxy-agent to v9
  • PR: #1559
• chore(deps): update devdependency non-major updates
  • PR: #1563
• fix(deps): update dependency @​actions/github to v9.1.0
  • PR: #1564
• chore(deps): update dependency vite to v8.0.8
  • PR: #1562
• chore(deps): update dependency undici to v8.0.3
  • PR: #1561
• chore(deps): update devdependency non-major updates
  • PR: #1566
• chore(deps): update mcr.microsoft.com/devcontainers/typescript-node:24-bullseye docker digest to 147a65f
  • PR: #1565
• chore(deps): update dependency undici to v8.1.0
  • PR: #1568
• chore(deps): lock file maintenance
  • PR: #1581
• chore(deps): update node devdependency non-major updates
  • PR: #1580
• fix(deps): update dependency @​actions/github to v9.1.1
  • PR: #1579
• fix(deps): update dependency @​actions/core to v3.0.1
  • PR: #1578
• chore(deps): update dependency vite to v8.0.9
  • PR: #1577
• chore(deps): update mikepenz/action-gh-release action to v3
  • PR: #1588
• chore(deps): lock file maintenance
  • PR: #1589
• chore(deps): update dependency vite to v8.0.11
  • PR: #1587

... (truncated)

Commits

• 348e88f Merge pull request #1590 from mikepenz/develop
• 9816d6c chore: recompile dist
• d9e4ec1 Merge pull request #1587 from mikepenz/renovate/vite-8.x
• 393b7ac chore(deps): lock file maintenance (#1589)
• b8176fa chore(deps): update mikepenz/action-gh-release action to v3 (#1588)
• 5d9a567 chore(deps): update dependency vite to v8.0.11
• b51ce95 Merge pull request #1586 from mikepenz/chore/pin-actions
• 1f6fce9 chore(ci): pin GitHub Actions to specific versions
• 9c3faaf Merge pull request #1577 from mikepenz/renovate/vite-8.x
• 0cd8201 Merge pull request #1578 from mikepenz/renovate/actions-core-3.x
• Additional commits viewable in compare view

Updates actions/stale from 10.2.0 to 10.3.0

Release notes

Sourced from actions/stale's releases.

v10.3.0

What's Changed

Bug Fix

• Enhancement: ignore stale labeling events by @​shamoon in actions/stale#1311

Dependency Updates

• Upgrade dependencies (@​actions/core, @​octokit/plugin-retry, @​typescript-eslint) by @​Copilot in actions/stale#1335

New Contributors

• @​shamoon made their first contribution in actions/stale#1311

Full Changelog: actions/stale@v10...v10.3.0

Commits

• eb5cf3a chore: upgrade dependencies and bump version to 10.3.0 (#1335)
• db5d06a Enhancement: ignore stale labeling events (#1311)
• See full diff in compare view

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
next	Ready	Preview, Comment	Jun 6, 2026 5:54am
react	Ready	Preview, Comment	Jun 6, 2026 5:54am

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.