[renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker/login-action	action	minor	v4.6.0 → v4.7.0
golangci/golangci-lint	uses-with	minor	v2.14.0 → v2.15.0
ossf/scorecard-action	action	minor	v2.4.4 → v2.5.0

---

Release Notes

docker/login-action

v4.7.0

Compare Source

• Preserve explicit ECR settings in registry-auth by @​crazy-max in #​1089
• Use registry hosts for scoped credentials by @​crazy-max in #​1088
• Raise Docker Hub OIDC max expiry to 6 hours by @​crazy-max in #​1068
• Log Docker Hub OIDC token exchange progress by @​crazy-max in #​1061
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1154.0 in #​1093
• Bump @​docker/actions-toolkit from 0.94.0 to 0.107.0 in #​1100
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in #​1077
• Bump csv-parse from 7.0.1 to 7.0.3 in #​1078
• Bump handlebars from 4.7.9 to 4.7.10 in #​1091
• Bump js-yaml from 5.2.2 to 5.5.0 in #​1066
• Bump postcss from 8.5.22 to 8.5.26 in #​1071
• Bump postcss-selector-parser from 7.1.1 to 7.1.6 in #​1092
• Bump source-map-js from 1.2.1 to 1.2.2 in #​1090
• Bump undici from 6.27.0 to 6.29.1 in #​1085
• Bump uuid from 14.0.1 to 14.0.3 in #​1096

Full Changelog: docker/login-action@v4.6.0...v4.7.0

golangci/golangci-lint

v2.15.0

Compare Source

Released on 2026-10-16

1. Linters new features or changes
   • errcheck: from 1.20.0 to 1.30.0
   • exhaustive: from 0.13.0 to 0.15.0 (⚠️ changes)
   • gocognit: from 1.2.1 to 1.3.0
   • golines: from 0.15.0 to 0.16.0
   • govet-modernize: from 0.50.0 to 0.52.0
   • loggercheck: from 0.12.0 to 0.13.0
   • predeclared: from 0.2.2 to 0.3.0
   • wrapcheck: from 2.12.0 to 2.13.0
2. Linters bug fixes
   • bidichk: from 0.3.3 to 0.3.4
   • canonicalheader: from a25c71c to e18e5c5
   • gofumpt: improve deprecation logs
   • gosec: improve concurrency default value
   • iface: from 1.5.1 to 1.5.3
   • paralleltest: from 1.0.15 to 1.0.16
   • revive: from 1.17.0 to 1.17.1
   • revive: the rules context-keys-type, errorf, modifies-value-receiver, range-val-address, string-of-int, time-equal, time-naming, unexported-return, unhandled-error, var-declaration are working (less randomly).
   • rowserrcheck: from c5f79b8 to e0740d5
   • staticcheck: from 0.8.1 to 0.8.2
3. Bug fixes
   • fix: compute custom version hash with module versions
   • fix: env vars loading (related to revive)

⚠️ Changes of the exhaustive linter:

• The replaced options still exists, and partially works, but they are deprecated.
• The options explicit-exhaustive-switch and explicit-exhaustive-map have been replaced by explicit-exhaustive.
• The check the value map has been replaced by mapliteral.
• The option ignore-enum-members (string) has been replaced by ignore-constants (slice).
• The option ignore-enum-types (string) has been replaced by ignore-types (slice).
• New report messages.
• The linter is a now a "slow" linter.

ossf/scorecard-action

v2.5.0

Compare Source

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted
services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the
Scorecard v5.6.0 release notes.

• The action's container image is built with Go 1.27.2 on a refreshed distroless base. by
  @​justaugustus in #​1716
• The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still
  recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @​justaugustus in #​1716
• The Scorecard version in results now always matches the Scorecard release the action is built
  with. by @​justaugustus in #​1718
• The action no longer prints the GitHub token variable while validating its options. by
  @​arpitjain099 in #​1709
• results_format accepts intoto, which wraps the JSON results in an in-toto attestation
  statement. by @​puerco in #​1702

Other

• Add a daily canary against Scorecard main by @​justaugustus in #​1711
• Bump Scorecard to the v5.6.0 candidate and fix the canary toolchain by @​justaugustus in #​1714
• Run Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update
  RELEASE.md by @​justaugustus in #​1716
• Bump Scorecard to v5.6.0 by @​justaugustus in #​1719

New Contributors

• @​arpitjain099 made their first contribution in #​1709
• @​puerco made their first contribution in #​1702

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.00%. Comparing base (c6e49b2) to head (87ffc19).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1980      +/-   ##
==========================================
- Coverage   89.01%   89.00%   -0.01%     
==========================================
  Files         111      111              
  Lines       12457    12457              
==========================================
- Hits        11088    11087       -1     
- Misses       1367     1368       +1     
  Partials        2        2              

see 1 file with indirect coverage changes

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update c6e49b2...87ffc19. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.