[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
aquasecurity/trivy	uses-with	patch	v0.76.1 → v0.76.2
azure/setup-helm	action	minor	v5.0.1 → v5.1.0
docker/login-action	action	minor	v4.7.0 → v4.8.0
peter-evans/create-pull-request	action	patch	v8.1.1 → v8.1.3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

aquasecurity/trivy

v0.76.2

Compare Source

🔐 Security update 🛡️

Trivy v0.76.2 bundles several security fixes:

• Official container images are rebuilt on Alpine 3.24.3, which fixes musl/musl-utils (CVE-2026-107891), and the build picks up fixed libcurl (24 CVEs, including HIGH CVE-2026-92392) and brotli-libs (CVE-2026-111497) from the v3.24 package repository.
• golang.org/x/net is bumped to v0.62.0, fixing two vulnerabilities in golang.org/x/net/html: CVE-2026-78661 (quadratic complexity when coalescing text nodes) and CVE-2026-97045 (missing ancestor namespace check when rendering raw text).
• github.com/go-jose/go-jose/v4 is bumped to v4.1.6, fixing GHSA-mgcc-cww5-fp2q.

We recommend upgrading to v0.76.2 and redeploying container images to apply these updates.

Changelog

• 3f6334d release: v0.76.2 [release/v0.76] (#​11552)
• 1cabe83 fix(deps): bump golang.org/x/net from 0.61.0 to 0.62.0 [backport: release/v0.76] (#​11554)
• be08de4 chore(deps): bump the common group across 1 directory with 14 updates [backport: release/v0.76] (#​11555)
• a8537d3 fix(deps): bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 [backport: release/v0.76] (#​11553)
• ae26b88 fix(deps): bump alpine to 3.24.3 in container images [backport: release/v0.76] (#​11551)

azure/setup-helm

v5.1.0

Compare Source

Added

• #​281 Read the Helm version from a .tool-versions file with the version-file input
• #​293 Resolve the latest patch for a major.minor version
• #​315 Add configurable checksum verification and fallback download mirrors

Fixed

• #​292 Preserve subpath base URLs when constructing Helm download URLs
• #​303 Retry latest-version lookups and add the latest-fallback opt-out

Security

• #​313 Update Undici security fixes
• #​307 Update Undici
• #​298 Update Undici

Changed

• #​314 Update the built-in Helm fallback from v3.18.4 to v4.3.1
• #​311 Enable stale cleanup after 74 inactive days
• #​306 Update the shared release workflow
• Update remaining dependency groups, development tools, and workflow actions (#​290, #​291, #​294, #​295, #​297, #​299, #​301, #​305, #​308, #​309, #​316)

docker/login-action

v4.8.0

Compare Source

• Set Docker Hub OIDC token lifetime default to 1 hour by @​crazy-max in #​1070
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1161.0 in #​1103
• Bump @​docker/actions-toolkit from 0.107.0 to 0.109.0 in #​1105
• Bump vite from 7.3.6 to 7.3.7 in #​1101

Full Changelog: docker/login-action@v4.7.0...v4.8.0

peter-evans/create-pull-request

v8.1.3: Create Pull Request v8.1.3

Compare Source

What's Changed

• fix: check git ref directly when pushing signed commits by @​peter-evans in #​4521
• Update distribution by @​actions-bot in #​4526

Full Changelog: peter-evans/create-pull-request@v8.1.2...v8.1.3

v8.1.2: Create Pull Request v8.1.2

Compare Source

What's Changed

• Update distribution by @​actions-bot in #​4361
• build(deps-dev): bump the npm group with 2 updates by @​dependabot[bot] in #​4372
• refactor: replace uuid dep with Node.js built-in crypto.randomUUID by @​peter-evans in #​4377
• build(deps): update to jest 30 by @​peter-evans in #​4388
• build(deps-dev): bump the npm group across 1 directory with 7 updates by @​dependabot[bot] in #​4391
• build(deps-dev): bump undici from 6.25.0 to 6.27.0 by @​dependabot[bot] in #​4386
• build(deps-dev): bump js-yaml from 4.2.0 to 5.0.0 by @​dependabot[bot] in #​4387
• chore: pin actions to commit shas by @​peter-evans in #​4406
• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group by @​dependabot[bot] in #​4411
• build(deps-dev): bump the npm group with 2 updates by @​dependabot[bot] in #​4418
• build(deps-dev): bump js-yaml from 5.2.0 to 5.2.1 by @​dependabot[bot] in #​4423
• build(deps-dev): bump js-yaml from 5.2.1 to 5.2.2 by @​dependabot[bot] in #​4430
• build(deps-dev): bump the npm group with 4 updates by @​dependabot[bot] in #​4436
• build(deps): bump the github-actions group with 2 updates by @​dependabot[bot] in #​4435
• build(deps): bump brace-expansion by @​dependabot[bot] in #​4446
• build(deps-dev): bump the npm group with 4 updates by @​dependabot[bot] in #​4452
• Update distribution by @​actions-bot in #​4457
• build(deps-dev): bump browserslist from 4.28.4 to 4.28.8 by @​dependabot[bot] in #​4462
• build(deps-dev): bump js-yaml from 4.2.0 to 5.4.2 by @​dependabot[bot] in #​4468
• build(deps-dev): bump undici from 6.28.0 to 6.29.0 by @​dependabot[bot] in #​4478
• build(deps-dev): bump the npm group with 4 updates by @​dependabot[bot] in #​4483
• build(deps): bump brace-expansion by @​dependabot[bot] in #​4486
• build(deps-dev): bump handlebars from 4.7.9 to 4.7.10 by @​dependabot[bot] in #​4494
• build(deps-dev): bump undici from 6.29.0 to 6.29.1 by @​dependabot[bot] in #​4504
• build(deps): bump the github-actions group with 3 updates by @​dependabot[bot] in #​4510
• build(deps-dev): bump the npm group with 4 updates by @​dependabot[bot] in #​4509
• Fix submodule deletion with sign-commits by @​MrSubidubi in #​4473

New Contributors

• @​MrSubidubi made their first contribution in #​4473

Full Changelog: peter-evans/create-pull-request@v8.1.1...v8.1.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.