chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
anchore/sbom-action	action	patch	v0.24.0 → v0.24.2
docker/setup-buildx-action	action	minor	v4.2.0 → v4.4.1
github.com/cert-manager/cert-manager	require	patch	v1.21.1 → v1.21.2
github/codeql-action	action	minor	v4.37.6 → v4.38.0
semgrep/semgrep	container	minor	1.172.0 → 1.177.0
step-security/harden-runner	action	minor	v2.20.0 → v2.21.1

---

Release Notes

anchore/sbom-action (anchore/sbom-action)

v0.24.2

Compare Source

Added Features

• bump eslint from 10.8.1 to 10.9.0 [#​724 @​dependabot]

Additional Changes

• add makefile target to bump syft [#​620 @​willmurphyscode]
• update zizmor workflow triggers [#​624 @​wagoodman]
• require zizmor security events [#​621 @​wagoodman]

(Full Changelog)

v0.24.1

Compare Source

docker/setup-buildx-action (docker/setup-buildx-action)

v4.4.1

Compare Source

v4.4.0

Compare Source

• Use official Buildx releases for cloud driver by @​crazy-max in #​606
• Pull BuildKit image before builder creation by @​crazy-max in #​609
• Use shared error helpers for Buildx and Docker commands by @​crazy-max in #​620
• Bump @​docker/actions-toolkit from 0.95.0 to 0.100.0 in #​610 #​618 #​619
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in #​614
• Bump js-yaml from 5.3.0 to 5.4.2 in #​608 #​617
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in #​611

Full Changelog: docker/setup-buildx-action@v4.3.0...v4.4.0

v4.3.0

Compare Source

• Bump @​docker/actions-toolkit from 0.92.0 to 0.95.0 in #​595
• Bump brace-expansion from 1.1.13 to 1.1.18 in #​600
• Bump js-yaml from 5.2.0 to 5.3.0 in #​585
• Bump postcss from 8.5.10 to 8.5.25 in #​598
• Bump undici from 6.27.0 to 6.28.0 in #​601

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

cert-manager/cert-manager (github.com/cert-manager/cert-manager)

v1.21.2

Compare Source

github/codeql-action (github/codeql-action)

v4.38.0

Compare Source

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #​4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #​4072
• Update default CodeQL bundle version to 2.27.0. #​4129

v4.37.9

Compare Source

• Update default CodeQL bundle version to 2.26.4. #​4106

v4.37.8

Compare Source

No user facing changes.

v4.37.7

Compare Source

• Update default CodeQL bundle version to 2.26.3. #​4085

step-security/harden-runner (step-security/harden-runner)

v2.21.1

Compare Source

What's Changed

• Improved performance of the disable-sudo feature.
• Fixed an issue in the Community tier where new endpoints required by the GitHub Actions runner were not being implicitly allowed in block mode.
• Fixed the Harden-Runner post step failing on Linux distributions that do not have a merged /usr filesystem layout (for example Debian 11), where /usr/bin/echo does not exist. This mainly affected self-hosted runners.
• Documentation updates: clarified which features are in the Community (free) vs Enterprise tier.

Full Changelog: step-security/harden-runner@v2.21.0...v2.21.1

v2.21.0

Compare Source

What's Changed

• Support for denied endpoints in block mode. This is included in the enterprise tier. Customers can deny outbound calls, for example, to public package registries.
• Improved Support for AWS CodeBuild GitHub Actions Runners.
• Bug fixes.

Full Changelog: step-security/harden-runner@v2.20.1...v2.21.0

v2.20.1

Compare Source

What's Changed

• AWS CodeBuild-hosted runner support
• Implicitly allow single-labeled (internal) domains in block-mode

Full Changelog: step-security/harden-runner@v2.20.0...v2.20.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 6 additional dependencies were updated

Details:

Package	Change
golang.org/x/crypto	v0.54.0 -> v0.56.0
golang.org/x/mod	v0.38.0 -> v0.40.0
golang.org/x/net	v0.57.0 -> v0.58.0
golang.org/x/text	v0.40.0 -> v0.41.0
golang.org/x/tools	v0.48.0 -> v0.49.0
google.golang.org/grpc	v1.83.0 -> v1.83.2