[MRegra]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action (changelog)	action	digest	9b32540 → 33d7b85
renovatebot/github-action	action	patch	v46.3.10 → v46.3.12

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

renovatebot/github-action

v46.3.12

Compare Source

Documentation

• update references to renovatebot/github-action to v46.3.11 (2d01910)

Miscellaneous Chores

• deps: update dependency @​containerbase/oxlint-plugin to v1.1.0 (8e810d3)
• deps: update pnpm to v10.34.8 (021fa2a)
• deps: update pnpm to v10.34.9 (f7cbc90)

Build System

• deps: lock file maintenance (6eccec3)

Continuous Integration

• deps: update ghcr.io/renovatebot/renovate docker tag to v44.198.3 (7b49be6)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.199.0 (704d70b)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.199.2 (6536601)

v46.3.11

Compare Source

Bug Fixes

• throw when 'docker run' fails (#​1088) (1e94228)

Documentation

• update references to renovatebot/github-action to v46.3.10 (d435328)

Miscellaneous Chores

• deps: update dependency npm-run-all2 to v9.0.4 (0d94545)
• deps: update dependency typescript-eslint to v8.72.0 (3372a91)
• deps: update node.js to v24.22.2 (c5155d6)
• replace eslint and prettier with oxlint and oxfmt (#​1089) (5b781a4)

Continuous Integration

• deps: update ghcr.io/renovatebot/renovate docker tag to v44.181.11 (aa5e565)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.182.2 (3b94e1a)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.184.1 (71fd7a5)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.186.6 (7713216)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.186.7 (eedc0c9)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.188.2 (0d6adaa)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.188.4 (e46333c)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.190.0 (2309c61)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.190.1 (d4d64e2)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.190.2 (9b215f4)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.192.2 (63e8d32)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.195.1 (74bb3e0)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.196.0 (eeca60a)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.198.0 (fd40403)

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[MRegra]

fleet review

reviewer: PASS

Routine Renovate bump of two pinned GitHub Actions SHAs (renovatebot/github-action v46.3.10→v46.3.12, codeql-action init/analyze patch). Minimal, in-scope, workflow-only change with no runtime/app impact. All 5 CI checks on the PR pass (CodeQL, build, codeql, renovate/stability-days, secrets). No regression test applicable/needed for a CI pin bump; the CI run itself is the validation and it's green.

attempted

• git diff origin/main...HEAD
• gh pr checks 14 -R MRegra/ascent

adversary: PASS

This Renovate PR moves two action pins in .github/workflows to new full 40-character commit SHAs: renovatebot/github-action goes from v46.3.10 to v46.3.12, and github/codeql-action/init+analyze moves to a newer commit on the v4 tag. I couldn't break it. Nothing else in the repo still uses the old SHAs. Every uses: in all three workflows is still pinned to a full SHA with a version comment. actionlint passes on both changed files. The with: inputs are the same as before. No permissions, triggers or secrets changed. The only Java-side step is mvn package in CodeQL, which doesn't change. A revert just restores the previous pins, so rollback is safe. One thing I couldn't check: whether the new SHAs really are the upstream tag commits. git ls-remote and WebFetch were both denied in this session.

• nit I couldn't confirm the new SHAs are real upstream tag commits (no network in the adversary sandbox) (.github/workflows/renovate.yml)
  The pins are full SHAs, which is the right way to pin. But I couldn't check that 1c0cf989c02653fba0efe7ca5772338860ca71dc is renovatebot/github-action tag v46.3.12, or that 33d7b85da1a04171e211befe2c739303b9a4c066 is github/codeql-action's current v4. A commit that exists only in a fork would show GitHub's "does not belong to any branch" warning. The commit was written by the Renovate bot (renovate@whitesourcesoftware.com) on branch renovate/github-actions-non-major, so this is low risk. The reviewer or CI should confirm before merge with gh api repos/renovatebot/github-action/git/refs/tags/v46.3.12 and gh api repos/github/codeql-action/git/refs/tags/v4.
  proof

`git ls-remote --tags https://github.com/renovatebot/github-action v46.3.12` → denied (don't-ask mode); web-fetch subagent → all WebFetch calls denied.

attempted

• git diff origin/main...HEAD: only 3 uses: lines change across 2 workflow files; no code, config or permission changes
• Searched for incomplete fixes: grep for uses: across .github shows no leftover old SHAs (9b3254085494…, 2804199d…) in ci.yml, security.yml or renovate.yml
• Supply chain: every action in the repo is still pinned by full 40-char SHA with a version comment; no mutable tags introduced
• actionlint .github/workflows/renovate.yml .github/workflows/security.yml → clean (no output)
• Input compatibility: the renovate step still passes only token plus env vars; the CodeQL init step still passes only languages: java-kotlin; nothing removed or renamed in these patch/minor bumps
• Security: top-level permissions: contents: read unchanged; no new secrets, triggers or pull_request_target
• Rollback: reverting the merge restores the previous SHA pins and has no state or migration effect
• Commit authorship: single commit by Renovate renovate@whitesourcesoftware.com, consistent with the bot
• Tried to confirm the SHAs upstream (git ls-remote, WebFetch): denied in this sandbox
• Did not run the Maven suite: no Java or pom change, and the tests don't exercise workflow files

security: PASS

This is a Renovate bump that touches only two CI action pins. renovatebot/github-action moves from 2804199 (v46.3.10) to 1c0cf98 (v46.3.12). github/codeql-action init and analyze both move from 9b32540 to 33d7b85 on the floating v4 line. Both stay pinned to full 40-character SHAs. Nothing else changes: no permissions:, triggers, secrets, scanner steps, tests or thresholds, so no gate is weakened. The workflows keep least privilege: renovate.yml runs only on schedule and workflow_dispatch with contents: read. The codeql job keeps security-events: write and contents: read, and there is no pull_request_target. I found nothing exploitable in the diff. One gap: I could not confirm online that the new SHAs match the upstream release tags, because network access was denied in this session. The harness's green-CI gate covers the CodeQL pin in practice: the Security workflow runs on this PR.

• nit New action SHAs not checked against upstream tags (network denied in review session) (.github/workflows/renovate.yml)
  The main supply-chain risk in a SHA bump is a commit that doesn't belong to the upstream repo, such as a commit from a fork. I tried gh api, git ls-remote and WebFetch to check that 1c0cf989c02653fba0efe7ca5772338860ca71dc is renovatebot/github-action tag v46.3.12 and that 33d7b85da1a04171e211befe2c739303b9a4c066 is on the github/codeql-action v4 line. The permission system denied all three. The risk is low: Renovate takes these digests from the upstream tags itself, and the commit author is the Renovate bot. The renovate step does get RENOVATE_TOKEN, a PAT with contents, pull-requests and workflows write. If someone wants extra assurance before merge, run git ls-remote https://github.com/renovatebot/github-action refs/tags/v46.3.12 and git ls-remote https://github.com/github/codeql-action 'refs/tags/v4*', and check that the SHAs match.
  proof

Here is what the diff shows. The pin goes from `renovatebot/github-action@2804199d260ad00c1fae0e9e842888369391c776 # v46.3.10` to `@1c0cf989c02653fba0efe7ca5772338860ca71dc # v46.3.12`. The codeql-action init and analyze pins go from `@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4` to `@33d7b85da1a04171e211befe2c739303b9a4c066 # v4`. Every attempt to check upstream was denied: `gh api`, `git ls-remote` and WebFetch all returned 'Permission ... denied'. HEAD 1341de4 was authored and committed by 'Renovate <renovate@whitesourcesoftware.com>'.

attempted

• git diff origin/main...HEAD: 2 files, 3 changed lines, all SHA pin bumps
• Read the full renovate.yml and security.yml. Permissions: renovate.yml has top-level contents: read; the codeql job has security-events: write and contents: read. Triggers: renovate.yml uses schedule and workflow_dispatch only; security.yml uses push, pull_request and schedule. No pull_request_target.
• Checked that no scanner, test or gate step was removed or loosened: CodeQL init and analyze, mvn package and gitleaks are all still there
• Checked the commit metadata (author is the Renovate bot) and renovate.json (scope is limited to the maven and github-actions managers)
• Tried to verify the new SHAs against the upstream tags with gh api, git ls-remote and WebFetch. All were denied by the session permission mode.

Approvals: 3/3 on 1341de4

🤖 Generated with Claude Code