build(deps): Bump the all-actions group across 1 directory with 5 updates

[dependabot]

Bumps the all-actions group with 5 updates in the / directory:

Package	From	To
step-security/harden-runner	2.15.1	2.16.0
treosh/lighthouse-ci-action	12.6.1	12.6.2
aquasecurity/trivy-action	0.34.2	0.35.0
sigstore/cosign-installer	4.0.0	4.1.0
anchore/sbom-action	0.23.0	0.23.1

Updates step-security/harden-runner from 2.15.1 to 2.16.0

Release notes

Sourced from step-security/harden-runner's releases.

v2.16.0

What's Changed

• Updated action.yml to use node24
• Security fix: Fixed a medium severity vulnerability where the egress block policy could be bypassed via DNS over HTTPS (DoH) by proxying DNS queries through a permitted resolver, allowing data exfiltration even with a restrictive allowed-endpoints list. This issue only affects the Community Tier; the Enterprise Tier is not affected. See GHSA-46g3-37rh-v698 for details.
• Security fix: Fixed a medium severity vulnerability where the egress block policy could be bypassed via DNS queries over TCP to external resolvers, allowing outbound network communication that evades configured network restrictions. This issue only affects the Community Tier; the Enterprise Tier is not affected. See GHSA-g699-3x6g-wm3g for details.

Full Changelog: step-security/harden-runner@v2.15.1...v2.16.0

Commits

• fa2e9d6 Release v2.16.0 (#646)
• See full diff in compare view

Updates treosh/lighthouse-ci-action from 12.6.1 to 12.6.2

Release notes

Sourced from treosh/lighthouse-ci-action's releases.

12.6.2

• Use node24
• Update deps: @​actions/core@​3.0.0, @​lhci/cli@​0.15.1

Commits

• 3e7e23f fix interpolation test
• 17aadfd update docs
• 68d5bca update lhci configs
• 69dc12e fix core import
• f18aeaf update deps
• b94e787 use node24 as a default runner
• 4198ec7 Fix typo in input description
• f82fba5 Update README.md
• 847bd5e README.md: bump GitHub action workflows
• See full diff in compare view

Updates aquasecurity/trivy-action from 0.34.2 to 0.35.0

Release notes

Sourced from aquasecurity/trivy-action's releases.

v0.35.0

What's Changed

• chore(deps): Update trivy to v0.69.3 by @​aqua-bot in aquasecurity/trivy-action#519

Full Changelog: aquasecurity/trivy-action@0.34.2...0.35.0

Commits

• 57a97c7 chore(deps): Update trivy to v0.69.3 (#519)
• See full diff in compare view

Updates sigstore/cosign-installer from 4.0.0 to 4.1.0

Release notes

Sourced from sigstore/cosign-installer's releases.

v4.1.0

What's Changed

We recommend updating as soon as possible as this includes bug fixes for Cosign. We also recommend removing with: cosign-release and strongly discourage using cosign-release unless you have a specific reason to use an older version of Cosign.

• Bump cosign to 3.0.5 in sigstore/cosign-installer#220
• fix: add retry to curl downloads for transient network failures in sigstore/cosign-installer#210

Full Changelog: sigstore/cosign-installer@v4.0.0...v4.1.0

Commits

• ba7bc0a fix: add retry to curl downloads for transient network failures (#210)
• 5a292e1 Bump cosign to 3.0.5 (#220)
• 351ea76 Bump actions/checkout from 6.0.1 to 6.0.2 (#217)
• c17565f test with go 1.26 too (#221)
• a6fdd19 Bump actions/setup-go from 6.1.0 to 6.3.0 (#218)
• 430b6a7 docs: fix registry from gcr.io to ghcr.io (#213)
• 4d14d7f feat: update to v3.0.3 (#212)
• f148005 fix: use env vars for template expansions; show curl errors (#207)
• c3f2d79 Bump actions/checkout from 6.0.0 to 6.0.1 (#208)
• b9a9af4 drop tests with go1.24 as it cant build (#211)
• Additional commits viewable in compare view

Updates anchore/sbom-action from 0.23.0 to 0.23.1

Release notes

Sourced from anchore/sbom-action's releases.

v0.23.1

⬆️ Dependencies

• chore(deps): update Syft to v1.42.2 (#607) [@anchore-actions-token-generator[bot]]
• chore(deps): bump fast-xml-parser and all other deps (#604) [@dependabot[bot]]

Commits

• 57aae52 chore(deps): update Syft to v1.42.2 (#607)
• c29e913 chore(deps): bump fast-xml-parser and other deps (#604)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions