This PR contains the following updates:

Package	Type	Update	Change
EmbarkStudios/cargo-deny-action	action	minor	v2.0.20 → v2.1.1
actions/checkout	action	minor	v6.0.3 → v6.1.0
github/codeql-action	action	minor	v4.36.2 → v4.37.4
j178/prek-action	action	patch	v2.0.5 → v2.0.6
taiki-e/install-action	action	minor	v2.82.7 → v2.85.5
zizmorcore/zizmor-action	action	minor	v0.5.7 → v0.6.1

---

Release Notes

EmbarkStudios/cargo-deny-action (EmbarkStudios/cargo-deny-action)

v2.1.1: Release 2.1.1 - cargo-deny 0.20.2

Compare Source

Fixed

• PR#116 fixed in issue introduced in the 2.1.0 release due the deprecation of the use-git-cli argument. Thanks @​Firestar99!

v2.1.0: Release 2.1.0 - cargo-deny 0.20.2

Compare Source

Changed

• PR#881 refactored the CLI, moving some duplicated options/flags into the root and removing several deprecated options/flags/values. See the PR for a full list of changes.

Added

• PR#879 resolved #​873 by adding a new bans.std-replacements lint which checks the graph for crates.io sourced crates that have been partially or fully replaced in std and/or core.

Fixed

• PR#880 resolved #​765 by respecting non-default build script paths in manifests.
• PR#881 resolved #​874 by cleaning up the CLI, deduplicating some options/flags that caused bug in the list subcommand.

actions/checkout (actions/checkout)

v6.1.0

Compare Source

github/codeql-action (github/codeql-action)

v4.37.4

Compare Source

v4.37.3

Compare Source

No user facing changes.

v4.37.2

Compare Source

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #​4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #​4007

v4.37.1

Compare Source

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #​3956
• Update default CodeQL bundle version to 2.26.1. #​4019

v4.37.0

Compare Source

• Update default CodeQL bundle version to 2.26.0. #​3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@​ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #​3973

v4.36.3

Compare Source

No user facing changes.

j178/prek-action (j178/prek-action)

v2.0.6

Compare Source

What's Changed

• Update known versions for prek 0.4.6 by @​j178 in #​159
• Update known versions for prek 0.4.8 by @​j178 in #​162
• Update known versions for prek 0.4.9 by @​j178 in #​163
• Update known versions for prek 0.4.10 by @​j178 in #​167
• Disable color in prek cache dir output by @​KSmanis in #​168

New Contributors

• @​KSmanis made their first contribution in #​168

Full Changelog: j178/prek-action@v2...v2.0.6

taiki-e/install-action (taiki-e/install-action)

v2.85.5

Compare Source

v2.85.4: 2.85.4

Compare Source

• Update uv@latest to 0.11.33.

• Update mise@latest to 2026.7.15.

• Update biome@latest to 2.5.6.

v2.85.3: 2.85.3

Compare Source

• Update xh@latest to 0.26.2.

• Update ubi@latest to 0.10.0.

• Update mise@latest to 2026.7.14.

• Update martin@latest to 1.13.0.

• Update cargo-shear@latest to 1.13.3.

• Update cargo-binstall@latest to 1.21.1.

v2.85.2: 2.85.2

Compare Source

• Update prek@latest to 0.4.11.

• Update mise@latest to 2026.7.13.

• Update kingfisher@latest to 1.109.0.

v2.85.1: 2.85.1

Compare Source

• Update vacuum@latest to 0.30.0.

• Update uv@latest to 0.11.32.

• Update mise@latest to 2026.7.12.

• Update cyclonedx@latest to 0.33.1.

• Update cargo-neat@latest to 0.5.2.

v2.85.0: 2.85.0

Compare Source

• Support wild (alias: wild-linker). (#​1949)

• Support bpf-linker. (#​1950)

• Support rafn. (#​1935, thanks @​DarkWanderer)

• Update cargo-neat@latest to 0.5.1.

• Update zizmor@latest to 1.28.0.

• Update wasmtime@latest to 47.0.2.

• Update uv@latest to 0.11.31.

• Update syft@latest to 1.49.0.

v2.84.1: 2.84.1

Compare Source

• Update wasmtime@latest to 47.0.1.

• Update wasm-tools@latest to 1.254.0.

• Update uv@latest to 0.11.30.

• Update mise@latest to 2026.7.11.

• Update cargo-neat@latest to 0.5.0.

• Update cargo-crap@latest to 0.3.1.

• Update biome@latest to 2.5.5.

v2.84.0: 2.84.0

Compare Source

• Support d2. (#​1944)

• Support protoc-gen-connect-openapi. (#​1922, thanks @​JasterV)

• Update convco@latest to 0.7.0. (#​1941, thanks @​graelo)

• Update just@latest to 1.57.0.

• Update cargo-semver-checks@latest to 0.49.0.

• Update tombi@latest to 1.2.4.

• Update cosign@latest to 3.1.2.

v2.83.4: 2.83.4

Compare Source

• Update vacuum@latest to 0.29.10.

• Update uv@latest to 0.11.29.

• Update syft@latest to 1.48.0.

• Update prek@latest to 0.4.10.

• Update mise@latest to 2026.7.7.

• Update cargo-shear@latest to 1.13.2.

v2.83.3: 2.83.3

Compare Source

• Update release-plz@latest to 0.3.160.

• Update prek@latest to 0.4.9.

• Update mise@latest to 2026.7.6.

• Update dprint@latest to 0.55.2.

• Update cargo-dinghy@latest to 0.8.5.

• Update cargo-binstall@latest to 1.21.0.

• Update biome@latest to 2.5.4.

v2.83.2: 2.83.2

Compare Source

• Update parse-dockerfile@latest to 0.1.8.

• Update mise@latest to 2026.7.5.

• Update just@latest to 1.56.0.

• Update gungraun-runner@latest to 0.19.4.

• Update cargo-neat@latest to 0.4.1.

v2.83.1: 2.83.1

Compare Source

• Update rclone@latest to 1.74.4.

• Update mise@latest to 2026.7.4.

• Update cargo-deny@latest to 0.20.2.

v2.83.0: 2.83.0

Compare Source

• Support cargo-about. (#​1924, thanks @​ruffsl)

• Update uv@latest to 0.11.28.

• Update martin@latest to 1.12.0.

• Update kingfisher@latest to 1.106.0.

• Update biome@latest to 2.5.3.

v2.82.11: 2.82.11

Compare Source

• Update wasm-tools@latest to 1.253.0.

• Update uv@latest to 0.11.27.

• Update mise@latest to 2026.7.2.

• Update mdbook@latest to 0.5.4.

v2.82.10: 2.82.10

Compare Source

• Update tombi@latest to 1.2.0.

• Update cargo-nextest@latest to 0.9.140.

v2.82.9: 2.82.9

Compare Source

• Update vacuum@latest to 0.29.9.

• Update prek@latest to 0.4.8.

• Update cargo-tarpaulin@latest to 0.37.0.

• Update cargo-leptos@latest to 0.3.7.

v2.82.8: 2.82.8

Compare Source

• Update vacuum@latest to 0.29.8.

• Update uv@latest to 0.11.26.

• Update typos@latest to 1.48.0.

• Update trivy@latest to 0.72.0.

• Update tombi@latest to 1.1.7.

• Update prek@latest to 0.4.6.

• Update mise@latest to 2026.7.0.

• Update just@latest to 1.55.1.

• Update biome@latest to 2.5.2.

zizmorcore/zizmor-action (zizmorcore/zizmor-action)

v0.6.1

Compare Source

zizmor 1.28.0 is now the default version used by the action.

v0.6.0

Compare Source

zizmor 1.27.0 is now the default version used by the action.

What's Changed

• Fold Docker image pull output into a collapsed Actions log group by @​woodruffw with @​Copilot in #​132
• Readme: document missing inputs by @​staabm in #​130
• ci: block version sync workflow on forks by @​shaanmajid in #​129
• Sync zizmor versions by @​github-actions[bot] in #​137
• Add collect input by @​woodruffw in #​139

New Contributors

• @​woodruffw with @​Copilot made their first contribution in #​132
• @​staabm made their first contribution in #​130
• @​shaanmajid made their first contribution in #​129

Full Changelog: zizmorcore/zizmor-action@v0.5.7...v0.6.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 5am on the first day of the month"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.