Update all dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
actions/checkout	action	major	v5.0.0 -> v6.0.1
actions/dependency-review-action	action	patch	v4.8.0 -> v4.8.2
actions/setup-go	action	minor	v6.0.0 -> v6.1.0
github.com/golangci/golangci-lint/v2	require	minor	v2.5.0 -> v2.6.2
github/codeql-action	action	minor	v4.30.7 -> v4.31.6
golang.org/x/tools	require	minor	v0.38.0 -> v0.39.0
mvdan.cc/gofumpt	require	patch	v0.9.1 -> v0.9.2
step-security/harden-runner	action	patch	v2.13.1 -> v2.13.3

---

Release Notes

actions/checkout (actions/checkout)

v6.0.1

Compare Source

v6.0.0

Compare Source

v5.0.1

Compare Source

What's Changed

• Port v6 cleanup to v5 by @​ericsciple in #​2301

Full Changelog: actions/checkout@v5...v5.0.1

actions/dependency-review-action (actions/dependency-review-action)

v4.8.2

Compare Source

Minor fixes:

• Fix PURL parsing for scoped packages (#​1008 from @​danielhardej)
• Fix for large summaries (#​1007 from @​gitulisca)
• README includes a working example for allow-dependencies-licenses (#​1009 from @​danielhardej)

v4.8.1: Dependency Review Action v4.8.1

Compare Source

What's Changed

• (bug) Fix spamming link test in deprecation warning (again) by @​ahpook in #​1000
• Bump version for 4.8.1 release by @​ahpook in #​1001

Full Changelog: actions/dependency-review-action@v4...v4.8.1

actions/setup-go (actions/setup-go)

v6.1.0

Compare Source

What's Changed

Enhancements

• Fall back to downloading from go.dev/dl instead of storage.googleapis.com/golang by @​nicholasngai in #​665
• Add support for .tool-versions file and update workflow by @​priya-kinthali in #​673
• Add comprehensive breaking changes documentation for v6 by @​mahabaleshwars in #​674

Dependency updates

• Upgrade eslint-config-prettier from 10.0.1 to 10.1.8 and document breaking changes in v6 by @​dependabot in #​617
• Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @​dependabot in #​641
• Upgrade semver and @​types/semver by @​dependabot in #​652

New Contributors

• @​nicholasngai made their first contribution in #​665
• @​priya-kinthali made their first contribution in #​673
• @​mahabaleshwars made their first contribution in #​674

Full Changelog: actions/setup-go@v6...v6.1.0

golangci/golangci-lint (github.com/golangci/golangci-lint/v2)

v2.6.2

Compare Source

Released on 2025-11-14

1. Bug fixes
   • fmt command with symlinks
   • use file depending on build configuration to invalidate cache
2. Linters bug fixes
   • testableexamples: from 1.0.0 to 1.0.1
   • testpackage: from 1.1.1 to 1.1.2

v2.6.1

Compare Source

v2.6.0

Compare Source

1. New linters
   • Add modernize analyzer suite
2. Linters new features or changes
   • arangolint: from 0.2.0 to 0.3.1
   • dupword: from 0.1.6 to 0.1.7 (new option comments-only)
   • go-critic: from 0.13.0 to 0.14.0 (new rules/checkers: zeroByteRepeat, dupOption)
   • gofumpt: from 0.9.1 to 0.9.2 ("clothe" naked returns is now controlled by the extra-rules option)
   • perfsprint: from 0.9.1 to 0.10.0 (new options: concat-loop, loop-other-ops)
   • wsl: from 5.2.0 to 5.3.0
3. Linters bug fixes
   • dupword: from 0.1.6 to 0.1.7
   • durationcheck: from 0.0.10 to 0.0.11
   • exptostd: from 0.4.4 to 0.4.5
   • fatcontext: from 0.8.1 to 0.9.0
   • forbidigo: from 2.1.0 to 2.3.0
   • ginkgolinter: from 0.21.0 to 0.21.2
   • godoc-lint: from 0.10.0 to 0.10.1
   • gomoddirectives: from 0.7.0 to 0.7.1
   • gosec: from 2.22.8 to 2.22.10
   • makezero: from 2.0.1 to 2.1.0
   • nilerr: from 0.1.1 to 0.1.2
   • paralleltest: from 1.0.14 to 1.0.15
   • protogetter: from 0.3.16 to 0.3.17
   • unparam: from 0df0534 to 5beb8c8
4. Misc.
   • fix: ignore some files to hash the version for custom build

github/codeql-action (github/codeql-action)

v4.31.6

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.6 - 01 Dec 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v4.31.5

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.5 - 24 Nov 2025

• Update default CodeQL bundle version to 2.23.6. #​3321

See the full CHANGELOG.md for more information.

v4.31.4

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.4 - 18 Nov 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v4.31.3

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.3 - 13 Nov 2025

• CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see Upcoming deprecation of CodeQL Action v3.
• Update default CodeQL bundle version to 2.23.5. #​3288

See the full CHANGELOG.md for more information.

v4.31.2

Compare Source

v4.31.1

Compare Source

v4.31.0

Compare Source

v4.30.9

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.9 - 17 Oct 2025

• Update default CodeQL bundle version to 2.23.3. #​3205
• Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #​3204

See the full CHANGELOG.md for more information.

v4.30.8

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.8 - 10 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

mvdan/gofumpt (mvdan.cc/gofumpt)

v0.9.2

Compare Source

This release moves the "clothe naked returns" rule under gofumpt -extra, following the discussion in #​285.

Binaries built on go version go1.25.3 linux/amd64 with:

CGO_ENABLED=0 go build -trimpath -ldflags="-w -s"

Consider becoming a sponsor if you benefit from the work that went into this release!

Note that this release no longer includes a sha256sums.txt asset; GitHub now provide digests natively.

step-security/harden-runner (step-security/harden-runner)

v2.13.3

Compare Source

v2.13.2

Compare Source

What's Changed

• Fixed an issue where there was a limit of 512 allowed endpoints when using block egress policy. This restriction has been removed, allowing for an unlimited number of endpoints to be configured.
• Harden Runner now automatically detects if the agent is already pre-installed on a custom VM image used by a GitHub-hosted runner. When detected, the action will skip reinstallation and use the existing agent.

Full Changelog: step-security/harden-runner@v2.13.1...v2.13.2

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​golangci/​golangci-lint/​v2@​v2.5.0 ⏵ v2.6.2	+1
	golang.org/​x/​tools@​v0.38.0 ⏵ v0.39.0	+1
	mvdan.cc/​gofumpt@​v0.9.1 ⏵ v0.9.2	+1

View full report

[renovate]

ℹ Artifact update notice

File name: hack/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 31 additional dependencies were updated

Details:

Package	Change
github.com/Abirdcfly/dupword	v0.1.6 -> v0.1.7
github.com/Masterminds/semver/v3	v3.3.1 -> v3.4.0
github.com/ashanbrown/forbidigo/v2	v2.1.0 -> v2.3.0
github.com/ashanbrown/makezero/v2	v2.0.1 -> v2.1.0
github.com/bombsimon/wsl/v5	v5.2.0 -> v5.3.0
github.com/catenacyber/perfsprint	v0.9.1 -> v0.10.0
github.com/charithe/durationcheck	v0.0.10 -> v0.0.11
github.com/ghostiam/protogetter	v0.3.16 -> v0.3.17
github.com/go-critic/go-critic	v0.13.0 -> v0.14.2
github.com/godoc-lint/godoc-lint	v0.10.0 -> v0.10.1
github.com/gofrs/flock	v0.12.1 -> v0.13.0
github.com/karamaru-alpha/copyloopvar	v1.2.1 -> v1.2.2
github.com/kunwardeep/paralleltest	v1.0.14 -> v1.0.15
github.com/ldez/exptostd	v0.4.4 -> v0.4.5
github.com/ldez/gomoddirectives	v0.7.0 -> v0.7.1
github.com/maratori/testableexamples	v1.0.0 -> v1.0.1
github.com/maratori/testpackage	v1.1.1 -> v1.1.2
github.com/nunnatsa/ginkgolinter	v0.21.0 -> v0.21.2
github.com/quasilyte/go-ruleguard	v0.4.4 -> v0.4.5
github.com/quasilyte/go-ruleguard/dsl	v0.3.22 -> v0.3.23
github.com/securego/gosec/v2	v2.22.8 -> v2.22.10
go.augendre.info/arangolint	v0.2.0 -> v0.3.1
go.augendre.info/fatcontext	v0.8.1 -> v0.9.0
golang.org/x/exp/typeparams	v0.0.0-20250911091902-df9299821621 -> v0.0.0-20251023183803-a4bb9ffd2546
golang.org/x/mod	v0.29.0 -> v0.30.0
golang.org/x/sync	v0.17.0 -> v0.18.0
golang.org/x/sys	v0.37.0 -> v0.38.0
golang.org/x/telemetry	v0.0.0-20251008203120-078029d740a8 -> v0.0.0-20251111182119-bc8e575c7b54
golang.org/x/text	v0.29.0 -> v0.30.0
google.golang.org/protobuf	v1.36.6 -> v1.36.8
mvdan.cc/unparam	v0.0.0-20250301125049-0df0534333a4 -> v0.0.0-20251027182757-5beb8c8f8f15