chore(deps): update github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
anthropics/claude-code-action	action	patch	v1.0.192 → v1.0.198	v1.0.201 (+2)
docker/setup-buildx-action	action	minor	v4.2.0 → v4.3.0
semgrep/semgrep	container	minor	1.173.0 → 1.174.0
taiki-e/install-action	action	minor	v2.85.13 → v2.86.4	v2.86.6 (+1)

---

Release Notes

anthropics/claude-code-action (anthropics/claude-code-action)

v1.0.198

Compare Source

v1.0.197

Compare Source

What's Changed

• fix: neutralize the checkout credential under actions/checkout v6+ include layout (#​1510) by @​TemRevil in #​1526

New Contributors

• @​TemRevil made their first contribution in #​1526

Full Changelog: anthropics/claude-code-action@v1.0.196...v1.0.197

v1.0.196

Compare Source

What's Changed

• fix(security): unify secret redaction in public comment outputs by @​Juwan-Hwang in #​1693
• fix: strip unused ALL_INPUTS environment variable from Claude subprocess env by @​Juwan-Hwang in #​1692
• fix(github): match bot actors in comment filters using GraphQL __typename by @​Neal006 in #​1616

New Contributors

• @​Juwan-Hwang made their first contribution in #​1693

Full Changelog: anthropics/claude-code-action@v1.0.195...v1.0.196

v1.0.195

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.194...v1.0.195

v1.0.194

Compare Source

What's Changed

• Harden delete_files MCP tool: validate paths within repo root (consistency with commit_files) by @​GabrielOnRails in #​1636
• Only limit fetch depth when the checkout is already shallow by @​winklemad in #​1647
• fix(base-action): add ~/.local/bin to $GITHUB_PATH after auto-install by @​anishesg in #​1643
• feat(context): include diffHunk in PR review comment context by @​rishavnaskar in #​1584
• ci: skip Claude-backed test jobs on fork PRs by @​ashwin-ant in #​1655
• fix: bump shell-quote to 1.8.4 to remediate CVE-2026-9277 by @​doshidhaval in #​1557
• fix(images): bound attachment downloads by @​abhinavkr26104 in #​1625

New Contributors

• @​GabrielOnRails made their first contribution in #​1636
• @​winklemad made their first contribution in #​1647
• @​doshidhaval made their first contribution in #​1557

Full Changelog: anthropics/claude-code-action@v1.0.193...v1.0.194

v1.0.193

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.192...v1.0.193

docker/setup-buildx-action (docker/setup-buildx-action)

v4.3.0

Compare Source

• Bump @​docker/actions-toolkit from 0.92.0 to 0.95.0 in #​595
• Bump brace-expansion from 1.1.13 to 1.1.18 in #​600
• Bump js-yaml from 5.2.0 to 5.3.0 in #​585
• Bump postcss from 8.5.10 to 8.5.25 in #​598
• Bump undici from 6.27.0 to 6.28.0 in #​601

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

taiki-e/install-action (taiki-e/install-action)

v2.86.4: 2.86.4

Compare Source

• Update oxfmt@latest to 1.79.0.

• Update mise@latest to 2026.8.8.

• Update martin@latest to 1.14.0.

• Update dprint@latest to 0.56.0.

• Update cargo-about@latest to 0.9.2.

• Update biome@latest to 2.5.9.

v2.86.3: 2.86.3

Compare Source

• Update prek@latest to 0.4.14.

• Update osv-scanner@latest to 2.5.1.

• Update cargo-llvm-cov@latest to 0.9.0.

v2.86.2: 2.86.2

Compare Source

• Update uv@latest to 0.12.5.

• Update mise@latest to 2026.8.6.

• Update cargo-tarpaulin@latest to 0.37.2.

v2.86.1: 2.86.1

Compare Source

• Fix an issue where oxfmt was　accidentally installed as oxfmt-{target}{exe}. (#​1969)

v2.86.0: 2.86.0

Compare Source

• Support oxfmt. (#​1967, thanks @​rami3l)

v2.85.14: 2.85.14

Compare Source

• Update uv@latest to 0.12.4.

• Update trivy@latest to 0.74.0.

• Update tombi@latest to 1.4.0.

• Update mdbook-mermaid@latest to 0.17.1.

• Update cargo-xwin@latest to 0.23.1.

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • "before 10am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	b441acd
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a8bd52f4651af00087ee4ce

[github-actions]

Native binary sizes (b441acd)

Final release artifacts built by the canonical build-upstream and build-windows-cli actions.

Artifact	Format	Base	PR	Change
vp (Linux x64)	Binary	10.74 MiB	10.74 MiB	0 B (0.00%)
vp (Linux x64)	gzip -9	4.65 MiB	4.65 MiB	0 B (0.00%)
NAPI (Linux x64)	Binary	32.20 MiB	32.20 MiB	0 B (0.00%)
NAPI (Linux x64)	gzip -9	12.69 MiB	12.69 MiB	0 B (0.00%)
vp (macOS ARM64)	Binary	8.03 MiB	8.03 MiB	0 B (0.00%)
vp (macOS ARM64)	gzip -9	4.05 MiB	4.05 MiB	0 B (0.00%)
NAPI (macOS ARM64)	Binary	39.79 MiB	39.79 MiB	0 B (0.00%)
NAPI (macOS ARM64)	gzip -9	16.99 MiB	16.99 MiB	0 B (0.00%)
vp (Windows x64)	Binary	8.63 MiB	8.63 MiB	0 B (0.00%)
vp (Windows x64)	gzip -9	3.77 MiB	3.77 MiB	-1 B (-0.00%)
NAPI (Windows x64)	Binary	27.04 MiB	27.04 MiB	0 B (0.00%)
NAPI (Windows x64)	gzip -9	10.76 MiB	10.76 MiB	+9 B (+0.00%)
Trampoline (Windows x64)	Binary	214.00 KiB	214.00 KiB	0 B (0.00%)
Trampoline (Windows x64)	gzip -9	103.20 KiB	103.20 KiB	+1 B (+0.00%)
Installer (Windows x64)	Binary	4.50 MiB	4.50 MiB	0 B (0.00%)
Installer (Windows x64)	gzip -9	2.11 MiB	2.11 MiB	-2 B (-0.00%)

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.