[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	minor	v4.38.3 → v4.39.1
openbao	HelmChart	patch	0.30.4 → 0.30.6
revanite-io/osps-baseline-action	action	patch	v1.5.2 → v1.5.4
securego/gosec	action	minor	v2.29.0 → v2.30.0
zgosalvez/github-actions-ensure-sha-pinned-actions	action	patch	v5.0.10 → v5.0.11

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

github/codeql-action

v4.39.1

Compare Source

• Update default CodeQL bundle version to 2.27.3. #​4256

v4.39.0

Compare Source

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #​4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #​4198

openbao/openbao-helm (openbao)

v0.30.6

Compare Source

• fix: ArtifactHub changes annotation

v0.30.5

Compare Source

• chore: bump OpenBao to v2.7.2

revanite-io/osps-baseline-action

v1.5.4

Compare Source

Changelog

🐛 Bug Fixes

• fix: bump the scanner to v0.33.1 @​ricochet (#​70)

🧰 Maintenance

• chore(deps): bump the dependencies group with 5 updates @​dependabot[bot] (#​69)

See details of all code changes since previous release

v1.5.3

Compare Source

Changelog

🐛 Bug Fixes

• fix: upload empty SARIF so fixed controls close their alerts @​jmeridth (#​67)

🧰 Maintenance

• chore(deps): bump the dependencies group with 5 updates @​dependabot[bot] (#​68)
• chore(deps): bump the dependencies group with 4 updates @​dependabot[bot] (#​66)

See details of all code changes since previous release

securego/gosec

v2.30.0

Compare Source

Changelog

• 5eb1d10 fix(g602): recognize equality comparison in minimumLenForBranch (#​1796)
• cc750dd fix(G112): honor read timeouts assigned through a struct field (#​1798)
• 1cbfd7e fix(G112): report read timeouts explicitly set to zero (#​1797)
• 05b9c4c feat(G706): extend log/slog method coverage (#​1795)
• 17ad2dd fix(autofix): read the first text block of a Claude response (#​1794)
• b23171c fix(autofix): give every AI request its own timeout (#​1793)
• 20b9e5b fix(resolve): treat constants from other packages as resolved (#​1792)
• 86d3c26 fix(autofix): return an error when a Gemini candidate has no content (#​1791)
• 14ef84f Update to go version 1.27.3 and 1.26.10 (#​1790)
• 7cbd7a9 fix(autofix): default Gemini model to gemini-3.1-pro-preview (#​1788)
• 1e26bce fix(G102): resolve concatenated and constant listen addresses (#​1787)
• 836dbdb fix: default -concurrency to GOMAXPROCS so container CPU limits apply (#​1786)
• bbd69e2 fix(g602): track statically known lengths for append results in slice bounds check (#​1773)
• 30e2d38 feat(rules): add G125 to detect unescaped url.JoinPath elements (#​1777)
• 57c45b8 fix: load absolute file paths so nested modules are analysed from the parent directory (#​1779)
• 77fa84e fix(G118): treat a cancel sent on a channel as handed off (#​1782)
• ca547ab fix(G112): honor read timeouts assigned after the http.Server literal (#​1781)
• 024084b fix(G303): resolve constant temp file paths (#​1784)
• 782eeb1 fix(deps): update all dependencies (#​1783)
• 707f227 fix(G203): treat constant template arguments as safe (#​1770)
• 8c5daa6 fix(G402): check TLS settings assigned through a *tls.Config (#​1769)
• 7157726 fix(deps): update all dependencies (#​1775)
• 7b1b5ce Update to go version 1.27.2 and 1.26.9 (#​1772)
• d2b649e Keep SARIF driver rules sorted and resolve rule indexes at the end (#​1767)
• 1f52e64 fix(G602): track append() results for slice bounds checking (#​1754)
• ea75d9f fix(deps): update all dependencies (#​1768)
• 65c2c08 fix(G602): trust len(nilSlice) == N guards, matching make()-backed slices (#​1752)
• 6ff893e fix(G407): treat an array IV/nonce as a zeroed buffer (#​1763)
• aaca894 fix(fileperms): resolve constant file and directory permissions (#​1766)
• 826f6f4 fix(G102): detect binding to the IPv6 unspecified address (#​1760)
• 021cc2e fix(G407): stop the nonce source walk on cycles (#​1761)
• ccb369d fix(G407): do not count AEAD.Seal as the read that fills its own nonce (#​1762)
• 9b31806 fix(deps): update all dependencies (#​1764)
• 8c77519 fix(G602): validate inequality len guards (#​1757)
• 027baa2 fix(G121): track request captured by closures (#​1759)
• 9ede89e fix(deps): update all dependencies (#​1756)
• 29a042e fix: make nosec suppression independent of comment order (#​1741)
• 6813471 fix(G403): resolve constant RSA key sizes (#​1751)
• 201d413 fix(G602): validate subslice bounds under equality guards (#​1749)
• accb424 fix(G124): resolve negated constant cookie flags (#​1748)
• 61fa1da fix(G602): report constant index equal to the length asserted by an equality guard (#​1746)
• 78fbcc7 Skip taint call graphs when no sinks match (#​1745)
• 79b4fcd Fix brittle test for html writer (#​1744)
• d70cac3 fix(G404): ignore non-cryptographic Shuffle calls (#​1742)
• 9e8e5d9 fix(deps): update all dependencies (#​1743)
• 8075fd2 fix(taint): remove Result.Source field that is never populated (#​1739)
• 58362d8 Update all dependencies (#​1737)
• d98945a Update go version 1.27.1 and 1.26.8 and phased out 1.25 (#​1738)
• 720c679 fix(report): correct Babel SRI hash (#​1736)
• 598d614 fix(taint): make wide caller traversal deterministic (#​1733)
• 4d447d9 fix(G702): skip the context argument of exec.CommandContext (#​1730)
• be1e315 feat(taint): name the sink in taint finding messages (#​1731)
• a102130 Update all dependencies (#​1734)
• 57f1613 Update action to gosec version 2.29.0 (#​1728)

zgosalvez/github-actions-ensure-sha-pinned-actions

v5.0.11

Compare Source

What's Changed

• Bump eslint from 10.11.0 to 10.12.0 by @​dependabot[bot] in #​357
• Bump undici from 6.29.0 to 6.29.1 by @​dependabot[bot] in #​358

Full Changelog: zgosalvez/github-actions-ensure-sha-pinned-actions@v5.0.10...v5.0.11

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.