[renovate]

This PR contains the following updates:

Package	Type	Update	Change
danielroe/uppt	action	patch	v0.6.11 → v0.6.12
voidzero-dev/setup-vp	action	patch	v1.21.1 → v1.21.2

---

Release Notes

danielroe/uppt

v0.6.12

Compare Source

compare changes

🚀 Enhancements

• pr: Allow customising release pr title (#​92)
• Support publishing to multiple dist-tags (#​91)
• Add support for custom PR preambles (#​83)

❤️ Contributors

• Joaquín Sánchez (@​userquin)
• Daniel Roe (@​danielroe)

voidzero-dev/setup-vp

v1.21.2

Compare Source

This patch release fixes command injection in GitLab inputs and Azure setupRef. GitLab and Azure now validate refs before downloading bootstrap scripts or runtimes.

The installer also prevents executable planting during sfw lookup. All integrations use Socket Firewall Free v1.15.4.

Registry authentication now requires an explicit registry-url input (registryUrl in Azure) or an existing auth entry in .npmrc. Jobs that previously relied on automatic token entries from registry URLs in repository files must update their configuration.

This release also isolates bundle rebuilds from the GitHub App token, expands native operating system test coverage, and updates dependencies.

What's Changed

• chore: upgrade Vite+ to 1.0.0-rc.0 by @​fengmk2 in #​173
• chore(deps): update pnpm to v12 by @​renovate[bot] in #​179
• chore(deps): update github actions (major) by @​renovate[bot] in #​176
• chore(deps): update vite-plus to v1.0.0 by @​renovate[bot] in #​174
• chore(deps): update dependency @​actions/cache to v6.3.0 by @​renovate[bot] in #​181
• chore(deps): update dependency socketdev/sfw-free to v1.15.4 by @​renovate[bot] in #​180
• chore(deps): update dependency vite-plus to v1 by @​renovate[bot] in #​177
• chore(deps): update pnpm package manager by @​renovate[bot] in #​178
• chore(deps): update vite-plus to v1.1.0 by @​renovate[bot] in #​182
• fix: prevent Azure setupRef command injection by @​fengmk2 in #​184
• ci: run the full unit suite on all supported operating systems by @​fengmk2 in #​185
• fix: isolate bundle rebuilds from the app token by @​fengmk2 in #​187
• fix: validate refs before CI bootstrap downloads by @​fengmk2 in #​188
• fix: publish rebuilt bundles from a trusted workflow by @​fengmk2 in #​189
• fix: require explicit registry input for generated auth by @​fengmk2 in #​191
• fix: prevent executable planting during sfw lookup by @​fengmk2 in #​190
• fix: prevent shell injection through GitLab inputs by @​fengmk2 in #​193

Full Changelog: voidzero-dev/setup-vp@v1.21.1...v1.21.2

---

Configuration

📅 Schedule: (in timezone Europe/Warsaw)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coldtea-pr-lens]

Note

renovate[bot] opened this pull request, so PR Lens left it undrawn. Comment @pr-lens draw to draw it

_{github.comment.notice: false in .github/pr-lens.yml turns this note off}