chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
anchore/sbom-action	action	patch	v0.24.0 → v0.24.2
docker/setup-buildx-action	action	minor	v4.2.0 → v4.3.0
github.com/stackitcloud/stackit-sdk-go/services/dns	require	minor	v0.21.0 → v0.22.1
github/codeql-action	action	patch	v4.37.6 → v4.37.9
semgrep/semgrep	container	minor	1.172.0 → 1.175.0
step-security/harden-runner	action	minor	v2.20.0 → v2.21.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

anchore/sbom-action (anchore/sbom-action)

v0.24.2

Compare Source

Added Features

• bump eslint from 10.8.1 to 10.9.0 [#​724 @​dependabot]

Additional Changes

• add makefile target to bump syft [#​620 @​willmurphyscode]
• update zizmor workflow triggers [#​624 @​wagoodman]
• require zizmor security events [#​621 @​wagoodman]

(Full Changelog)

v0.24.1

Compare Source

docker/setup-buildx-action (docker/setup-buildx-action)

v4.3.0

Compare Source

• Bump @​docker/actions-toolkit from 0.92.0 to 0.95.0 in #​595
• Bump brace-expansion from 1.1.13 to 1.1.18 in #​600
• Bump js-yaml from 5.2.0 to 5.3.0 in #​585
• Bump postcss from 8.5.10 to 8.5.25 in #​598
• Bump undici from 6.27.0 to 6.28.0 in #​601

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

github/codeql-action (github/codeql-action)

v4.37.9

Compare Source

• Update default CodeQL bundle version to 2.26.4. #​4106

v4.37.8

Compare Source

No user facing changes.

v4.37.7

Compare Source

• Update default CodeQL bundle version to 2.26.3. #​4085

step-security/harden-runner (step-security/harden-runner)

v2.21.0

Compare Source

What's Changed

• Support for denied endpoints in block mode. This is included in the enterprise tier. Customers can deny outbound calls, for example, to public package registries.
• Improved Support for AWS CodeBuild GitHub Actions Runners.
• Bug fixes.

Full Changelog: step-security/harden-runner@v2.20.1...v2.21.0

v2.20.1

Compare Source

What's Changed

• AWS CodeBuild-hosted runner support
• Implicitly allow single-labeled (internal) domains in block-mode

Full Changelog: step-security/harden-runner@v2.20.0...v2.20.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.