chore(deps): update all-ci-updates

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
aquasecurity/trivy-action	action	minor	0.35.0 → v0.36.0
argo-cd		patch	9.5.2 → 9.5.12	9.5.15 (+2)
github/codeql-action	action	patch	v4.35.2 → v4.35.3	v4.35.5 (+1)
goreleaser/goreleaser-action	action	minor	v7.1.0 → v7.2.1	v7.2.2
securego/gosec	action	minor	v2.25.0 → v2.26.1
sigstore/cosign-installer	action	patch	v4.1.1 → v4.1.2

---

Release Notes

aquasecurity/trivy-action (aquasecurity/trivy-action)

v0.36.0

Compare Source

What's Changed

• chore(ci): update bump-trivy workflow by @​DmitriyLewen in #​546
• ci: use action.yaml as single source of truth for Trivy version by @​nikpivkin in #​552
• ci: replace peter-evans/create-pull-request with gh CLI by @​nikpivkin in #​550
• test: use pinned digests for trivy-db, trivy-java-db and trivy-checks by @​nikpivkin in #​555
• ci: add dependabot config by @​nikpivkin in #​556
• chore: add zizmor config by @​nikpivkin in #​557
• chore(deps): bump the actions group with 5 updates by @​dependabot[bot] in #​558
• fix: use portable shebang in entrypoint.sh by @​Hayao0819 in #​545
• Fix typo in GOOGLE_APPLICATION_CREDENTIALS env var name by @​patrik-csak in #​547
• Upgrade Trivy action version from 0.33.1 to 0.35.0 fixes #​549 by @​Aditya09-cse in #​548
• chore: use GitHub Actions as git commit author in bump-trivy workflow by @​nikpivkin in #​561
• chore(deps): Update trivy to v0.70.0 by @​Argon-DevOps-Mgt in #​559
• chore: update action version to v0.36.0 in examples by @​nikpivkin in #​563

New Contributors

• @​dependabot[bot] made their first contribution in #​558
• @​Hayao0819 made their first contribution in #​545
• @​patrik-csak made their first contribution in #​547
• @​Aditya09-cse made their first contribution in #​548
• @​Argon-DevOps-Mgt made their first contribution in #​559

Full Changelog: aquasecurity/trivy-action@v0.35.0...v0.36.0

argoproj/argo-helm (argo-cd)

v9.5.12

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• chore(deps): update ghcr.io/renovatebot/renovate docker tag to v43.160.4 by @​argoproj-renovate[bot] in #​3868
• chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 in the dependencies group by @​dependabot[bot] in #​3870
• chore(deps): update renovatebot/github-action action to v46.1.13 by @​argoproj-renovate[bot] in #​3872
• chore(argo-cd): Update dependency argoproj/argo-cd to v3.4.1 by @​argoproj-renovate[bot] in #​3876

Full Changelog: argoproj/argo-helm@argo-cd-9.5.11...argo-cd-9.5.12

v9.5.11

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• chore(argo-cd): Update dependency argoproj/argo-cd to v3.3.9 by @​argoproj-renovate[bot] in #​3867

Full Changelog: argoproj/argo-helm@argo-cd-9.5.10...argo-cd-9.5.11

v9.5.10

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• chore(deps): bump step-security/harden-runner from 2.16.0 to 2.19.0 in the dependencies group across 1 directory by @​dependabot[bot] in #​3850
• chore(argo-cd): Update ghcr.io/oliver006/redis_exporter Docker tag to v1.83.0 by @​argoproj-renovate[bot] in #​3866

Full Changelog: argoproj/argo-helm@argo-cd-9.5.9...argo-cd-9.5.10

v9.5.9

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• fix(argo-cd): fixed service port issue with applicationset webhook httproute by @​dromadaire54 in #​3862

Full Changelog: argoproj/argo-helm@argo-cd-9.5.8...argo-cd-9.5.9

v9.5.8

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• chore(deps): update renovatebot/github-action action to v46.1.12 by @​argoproj-renovate[bot] in #​3861
• fix(argo-cd): support empty matches in GRPCRoute and HTTPRoute rules by @​yurrriq in #​3604

Full Changelog: argoproj/argo-helm@argo-cd-9.5.7...argo-cd-9.5.8

v9.5.7

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• feat(argo-cd): Make PrometheusRule API version field overridable like it is in ServiceMonitor manifests. by @​rurod in #​3857

New Contributors

• @​rurod made their first contribution in #​3857

Full Changelog: argoproj/argo-helm@argo-cd-9.5.6...argo-cd-9.5.7

v9.5.6

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• feat(argo-cd): adding httproute support to applicationset webhook by @​dromadaire54 in #​3859

New Contributors

• @​dromadaire54 made their first contribution in #​3859

Full Changelog: argoproj/argo-helm@argo-cd-9.5.5...argo-cd-9.5.6

v9.5.5

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• ci(github): add draft PR lifecycle workflows by @​jmeridth in #​3794
• fix(github): skip draft lifecycle workflows for bot-authored PRs by @​jmeridth in #​3851
• fix(github): correct renovate bot actor name in draft lifecycle workflows by @​jmeridth in #​3855
• chore(deps): update renovatebot/github-action action to v46.1.11 by @​argoproj-renovate[bot] in #​3854
• fix(argo-cd): fix ArgoAppNotSynced PrometheusRule annotation template syntax by @​vrivellino in #​3853

New Contributors

• @​vrivellino made their first contribution in #​3853

Full Changelog: argoproj/argo-helm@argo-workflows-1.0.13...argo-cd-9.5.5

v9.5.4

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• chore(argo-cd): Change order of source URL by @​nebula-it in #​3837

New Contributors

• @​nebula-it made their first contribution in #​3837

Full Changelog: argoproj/argo-helm@argo-cd-9.5.3...argo-cd-9.5.4

v9.5.3

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• chore(deps): bump the dependencies group with 2 updates by @​dependabot[bot] in #​3838
• chore(deps): update renovatebot/github-action action to v46.1.10 by @​argoproj-renovate[bot] in #​3839
• chore(argo-cd): Update dependency argoproj/argo-cd to v3.3.8 by @​argoproj-renovate[bot] in #​3841

Full Changelog: argoproj/argo-helm@argo-cd-9.5.2...argo-cd-9.5.3

github/codeql-action (github/codeql-action)

v4.35.3

Compare Source

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #​3837
• Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #​3850
• Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #​3853
• Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #​3852
• Update default CodeQL bundle version to 2.25.3. #​3865

goreleaser/goreleaser-action (goreleaser/goreleaser-action)

v7.2.1

Compare Source

This fully removes the usage of the old nightly moving tag.

Full Changelog: goreleaser/goreleaser-action@v7.2.0...v7.2.1

v7.2.0

Compare Source

What's Changed

• test: cover install across release eras by @​caarlos0 in #​555
• feat: add version-file input by @​caarlos0 in #​556
• feat: resolve nightly to latest vX.Y.Z--nightly release by @​caarlos0 in #​558

Full Changelog: goreleaser/goreleaser-action@v7...v7.2.0

securego/gosec (securego/gosec)

v2.26.1

Compare Source

Changelog

• 4a3bd8a Update cosign to v3.0.6 (#​1659)

v2.26.0

Compare Source

sigstore/cosign-installer (sigstore/cosign-installer)

v4.1.2

Compare Source

What's Changed

• Bump cosign to 3.0.6 in #​232

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 11.56%. Comparing base (7a65ab7) to head (85460e3).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1902   +/-   ##
=======================================
  Coverage   11.56%   11.56%           
=======================================
  Files         248      248           
  Lines       11405    11405           
=======================================
  Hits         1319     1319           
  Misses      10041    10041           
  Partials       45       45           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.