chore(deps): update github actions (minor)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/cache	action	minor	v5.0.5 → v5.1.0
actions/setup-node	action	minor	v6.4.0 → v6.5.0
changesets/action	action	minor	v1.8.0 → v1.9.0
docker/build-push-action	action	minor	v7.2.0 → v7.3.0
docker/login-action	action	minor	v4.2.0 → v4.4.0	v4.5.2 (+2)
docker/metadata-action	action	minor	v6.1.0 → v6.2.0
docker/setup-buildx-action	action	minor	v4.1.0 → v4.2.0
docker/setup-qemu-action	action	minor	v4.1.0 → v4.2.0
github/codeql-action	action	minor	v4.36.3 → v4.37.0	v4.37.3 (+2)

---

Release Notes

actions/cache (actions/cache)

v5.1.0

Compare Source

What's Changed

• Bump @​actions/cache to v5.1.0 - handle read-only cache access by @​jasongin in #​1775

Full Changelog: actions/cache@v5...v5.1.0

actions/setup-node (actions/setup-node)

v6.5.0

Compare Source

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in #​1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

changesets/action (changesets/action)

v1.9.0

Compare Source

Minor Changes

• #​636 b072bcc Thanks @​bluwy! - Add a new @changesets/action/pr-comment sub-action to comment on PRs

• #​625 8795eee Thanks @​bluwy! - Add a new @changesets/action/pr-status sub-action to generate the changeset status comment for PRs as an alternative to the Changesets Bot.

Patch Changes

• #​535 34f64f6 Thanks @​Andarist! - Fixed an issue with GitHub releases not being created for successfully published packages when some packages failed to be published to the registry.

• #​632 1d54b9e Thanks @​bluwy! - Simplify internal implementation to get changelog entries for a package version

• #​629 e0c90aa Thanks @​bluwy! - Fix custom version and publish command argument parsing

• #​645 f9585d9 Thanks @​Andarist! - Improved force-push handling when using commitMode: "github-api" so updating an existing branch no longer temporarily resets the target branch to the base commit, avoiding cases where GitHub closes open pull requests during the update. This should remove a possibility of a GitHub state race that caused the force-pushed PRs not being reopened.

docker/build-push-action (docker/build-push-action)

v7.3.0

Compare Source

docker/login-action (docker/login-action)

v4.4.0

Compare Source

v4.3.0

Compare Source

• Preserve names in esbuild bundle by @​crazy-max in #​1022
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1076.0 #​999 #​1030
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in #​1004 #​1027
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in #​1023
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in #​1029
• Bump http-proxy-agent and https-proxy-agent to 9.1.0 in #​1017
• Bump js-yaml from 4.1.1 to 5.2.0 in #​1028
• Bump sigstore from 4.1.0 to 4.1.1 in #​1031
• Bump tmp from 0.2.5 to 0.2.7 in #​1002
• Bump undici from 6.24.1 to 6.27.0 in #​1020
• Bump vite from 7.3.3 to 7.3.6 in #​1019

Full Changelog: docker/login-action@v4.2.0...v4.3.0

docker/metadata-action (docker/metadata-action)

v6.2.0

Compare Source

docker/setup-buildx-action (docker/setup-buildx-action)

v4.2.0

Compare Source

• Preserve names in esbuild bundle by @​crazy-max in #​572
• Bump @​actions/core from 3.0.0 to 3.0.1 in #​551
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in #​557 #​580
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in #​573
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in #​576
• Bump js-yaml from 4.1.1 to 5.2.0 in #​562
• Bump sigstore from 4.1.0 to 4.1.1 in #​577
• Bump tmp from 0.2.5 to 0.2.7 in #​556
• Bump undici from 6.25.0 to 6.27.0 in #​570
• Bump vite from 7.3.2 to 7.3.6 in #​569

Full Changelog: docker/setup-buildx-action@v4.1.0...v4.2.0

docker/setup-qemu-action (docker/setup-qemu-action)

v4.2.0

Compare Source

github/codeql-action (github/codeql-action)

v4.37.0

Compare Source

• Update default CodeQL bundle version to 2.26.0. #​3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@​ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #​3973

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • "before 9am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 57b1585

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates pinned GitHub Actions dependencies across CI/CD workflows to newer patch/minor versions for caching, releases, Docker builds, and SARIF uploads.

Changes:

• Bump actions/cache from v5.0.5 to v5.1.0 across multiple workflows.
• Bump changesets/action from v1.8.0 to v1.9.0 in the release workflow.
• Bump Docker-related actions (login/setup-qemu/setup-buildx/metadata/build-push) and github/codeql-action/upload-sarif to newer versions in image build workflows.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/release.yaml	Updates cache action and Changesets action versions used during release automation.
.github/workflows/deploy-pr-preview.yaml	Updates pnpm cache action version for PR preview deployments.
.github/workflows/deploy-github-pages.yaml	Updates pnpm cache action version for GitHub Pages deployments.
.github/workflows/ci-checks.yaml	Updates pnpm cache action version used in CI jobs.
.github/workflows/build-push-supernova-image.yaml	Updates Docker build/push pipeline actions and SARIF upload action versions.
.github/workflows/build-push-greenhouse-pr-preview.yaml	Updates Docker build/push pipeline actions for PR preview builds.
.github/workflows/build-push-greenhouse-image.yaml	Updates Docker build/push pipeline actions and SARIF upload action versions.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (4)

.github/workflows/ci-checks.yaml:41

• The same action SHAs are repeated across multiple workflow files/jobs in this PR, increasing the chance of future version drift (e.g., updating one workflow but missing another). Consider centralizing the shared ‘setup node + pnpm + cache’ logic into a reusable workflow (workflow_call) or a composite action under .github/actions/... so action pins are defined in one place and reused everywhere.

        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0

.github/workflows/ci-checks.yaml:55

• The same action SHAs are repeated across multiple workflow files/jobs in this PR, increasing the chance of future version drift (e.g., updating one workflow but missing another). Consider centralizing the shared ‘setup node + pnpm + cache’ logic into a reusable workflow (workflow_call) or a composite action under .github/actions/... so action pins are defined in one place and reused everywhere.

      - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0

.github/workflows/ci-checks.yaml:90

• The same action SHAs are repeated across multiple workflow files/jobs in this PR, increasing the chance of future version drift (e.g., updating one workflow but missing another). Consider centralizing the shared ‘setup node + pnpm + cache’ logic into a reusable workflow (workflow_call) or a composite action under .github/actions/... so action pins are defined in one place and reused everywhere.

        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0

.github/workflows/ci-checks.yaml:104

• The same action SHAs are repeated across multiple workflow files/jobs in this PR, increasing the chance of future version drift (e.g., updating one workflow but missing another). Consider centralizing the shared ‘setup node + pnpm + cache’ logic into a reusable workflow (workflow_call) or a composite action under .github/actions/... so action pins are defined in one place and reused everywhere.

      - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0