chore(deps): update github-actions dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github/codeql-action	v4.37.6 → v4.37.9
orhun/git-cliff-action	v4.8.0 → v4.9.0
pnpm/action-setup	v6.0.10 → v6.1.0
step-security/harden-runner	v2.20.1 → v2.21.1
zizmorcore/zizmor-action	v0.6.2 → v0.6.3

---

Release Notes

github/codeql-action (github/codeql-action)

v4.37.9

Compare Source

• Update default CodeQL bundle version to 2.26.4. #​4106

v4.37.8

Compare Source

No user facing changes.

v4.37.7

Compare Source

• Update default CodeQL bundle version to 2.26.3. #​4085

orhun/git-cliff-action (orhun/git-cliff-action)

v4.9.0

Compare Source

[4.9.0] - 2026-09-01

🐛 Bug Fixes

• Use BSD-compatible stat format on macOS (#​80)
• (action) Terminate content output with a newline (#​81)

⚙️ Miscellaneous Tasks

• (sync) Resolve github cli login (#​79)
• Bump git-cliff to v2.14.1 (#​85)

pnpm/action-setup (pnpm/action-setup)

v6.1.0

Compare Source

What's Changed

• feat: support pnpm v12 by @​zkochan in #​288

Full Changelog: pnpm/action-setup@v6.0.10...v6.1.0

step-security/harden-runner (step-security/harden-runner)

v2.21.1

Compare Source

What's Changed

• Improved performance of the disable-sudo feature.
• Fixed an issue in the Community tier where new endpoints required by the GitHub Actions runner were not being implicitly allowed in block mode.
• Fixed the Harden-Runner post step failing on Linux distributions that do not have a merged /usr filesystem layout (for example Debian 11), where /usr/bin/echo does not exist. This mainly affected self-hosted runners.
• Documentation updates: clarified which features are in the Community (free) vs Enterprise tier.

Full Changelog: step-security/harden-runner@v2.21.0...v2.21.1

v2.21.0

Compare Source

What's Changed

• Support for denied endpoints in block mode. This is included in the enterprise tier. Customers can deny outbound calls, for example, to public package registries.
• Improved Support for AWS CodeBuild GitHub Actions Runners.
• Bug fixes.

Full Changelog: step-security/harden-runner@v2.20.1...v2.21.0

zizmorcore/zizmor-action (zizmorcore/zizmor-action)

v0.6.3

Compare Source

zizmor 1.30.0 is now the default version.

Release notes: https://docs.zizmor.sh/release-notes/#​1300

---

Configuration

📅 Schedule: (in timezone Asia/Kolkata)

• Branch creation
  • "on the first day of the month"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
ask-widget	Ignored		Sep 5, 2026 8:39am UTC