chore(deps): update all-ci-dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-go	action	minor	v6.3.0 → v6.4.0
codecov/codecov-action	action	patch	v5.5.2 → v5.5.4
openbao		minor	0.25.6 → 0.27.2
securego/gosec	action	minor	v2.23.0 → v2.25.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/setup-go (actions/setup-go)

v6.4.0

Compare Source

What's Changed

Enhancement

• Add go-download-base-url input for custom Go distributions by @​gdams in #​721

Dependency update

• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in #​727

Documentation update

• Rearrange README.md, add advanced-usage.md by @​priyagupta108 in #​724
• Fix Microsoft build of Go link by @​gdams in #​734

New Contributors

• @​gdams made their first contribution in #​721

Full Changelog: actions/setup-go@v6...v6.4.0

codecov/codecov-action (codecov/codecov-action)

v5.5.4

Compare Source

This is a mirror of v5.5.2. v6 will be released which requires node24

What's Changed

• Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0" by @​thomasrockhu-codecov in #​1926
• chore(release): 5.5.4 by @​thomasrockhu-codecov in #​1927

Full Changelog: codecov/codecov-action@v5.5.3...v5.5.4

v5.5.3

Compare Source

What's Changed

• build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @​dependabot[bot] in #​1874
• chore(release): bump to 5.5.3 by @​thomasrockhu-codecov in #​1922

Full Changelog: codecov/codecov-action@v5.5.2...v5.5.3

openbao/openbao-helm (openbao)

v0.27.2

Compare Source

• chore: update to openbao 2.5.3
• chore: update to openbao-csi-provider 2.0.2

v0.27.1

Compare Source

• feat: Allow configuring Grafana dashboard namespace

v0.27.0

Compare Source

• feat: Make injector.external(Bao|Vault)Addr take precendence over global.external(Bao|Vault)Addr

v0.26.3

Compare Source

• feat: Default to runtimeDefault Seccomp profile

v0.26.2

Compare Source

• chore: Update OpenBao to version 2.5.2

v0.26.1

Compare Source

• fix: add appProtocol on Service ports

v0.26.0

Compare Source

• feat: Allow setting tolerations for snapshot-agent cronjob pod

v0.25.7

Compare Source

• fix: Add job selector in Grafana dashboard

securego/gosec (securego/gosec)

v2.25.0

Compare Source

Changelog

• 223e19b chore(deps): bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#​1617)
• b23a9e5 fix: allow barry action to access secrets on fork PRs (#​1616)
• 355cfa5 fix: reduce G117 false positives for custom marshalers and transformed values (#​1614) (#​1615)
• 744bfb5 Add barry security scanner as a step in the CI (#​1612)
• 4fde15d chore(deps): update all dependencies (#​1611)
• dec52c4 fix: prevent taint analysis hang on packages with many CHA call graph edges (#​1608) (#​1610)
• a0de8b6 Add some skills for claude code to automate some tasks (#​1609)
• c2dfcec Add G701-G706 rule-to-CWE mappings and CWE-117, CWE-918 entries (#​1606)
• 8aec3f4 fix: skip SSA analysis on ill-typed packages to prevent panic (#​1607)
• 1ced32d Port G120 from SSA-based to taint analysis (fixes #​1600, #​1603) (#​1605)
• befce8d fix(G118): eliminate false positive for package-level cancel variables (#​1602)
• b7b2c7b feat: add G124 rule for insecure HTTP cookie configuration (#​1599)
• 6e66a94 feat: add G709 rule for unsafe deserialization of untrusted data (#​1598)
• e7ea237 feat: add G708 rule for server-side template injection via text/template (#​1597)
• 8895462 fix(G118): eliminate false positive when cancel is called via struct field in a closure (#​1596)
• 619ce21 Fix infinite recursion in interprocedural taint analysis (#​1594)
• 0e0eb17 Fix G118 false positive when cancel is stored in returned struct field (#​1593)
• 59a9da0 Fix G118 false positive on cancel called inside goroutine closure (#​1592)
• cbf46b8 fix(analyzer): per-package rule instantiation eliminates concurrent map crash (#​1589)
• c6c3ba8 chore(deps): update all dependencies (#​1588)
• c709ed8 fix(G118): treat returned cancel func as called (fixes #​1584) (#​1585)
• fa74dd7 chore(go): update supported Go versions to 1.25.8 and 1.26.1 (#​1583)
• cd1f29e Update the README with the correct version of the Github action for gosec (#​1582)
• 5887aee chore(deps): update all dependencies (#​1579)
• 6641fcf Fix G115 false positives for guarded int64-to-byte conversions (#​1578)
• 3c9c3da Update the container image migration notice (#​1576)
• 973e94e chore(action): bump gosec to 2.24.7 (#​1575)

v2.24.7

Compare Source

Changelog

• bb17e42 Ignore nosec comments in action integration workflow to generate some warnings (#​1573)
• e1502ad Add a workflow for action integration test (#​1571)
• f8691bd fix(sarif): avoid invalid null relationships in SARIF output (#​1569)
• ade1d0e chore: migrate gosec container image references to GHCR (#​1567)

v2.24.6

Compare Source

Changelog

• 88835e8 Update gorelease to use the latest cosign bundle argument (#​1565)

v2.24.5

Compare Source

v2.24.4

Compare Source

v2.24.3

Compare Source

v2.24.2

Compare Source

v2.24.1

Compare Source

v2.24.0

Compare Source

Changelog

• 271492b fix: G704 false positive on const URL (#​1551)
• 1341aea fix(G705): eliminate false positive for non-HTTP io.Writer (#​1550)
• f2262c8 G120: avoid false positive when MaxBytesReader is applied in middleware (#​1547)
• 5b580c7 Fix G602 regression coverage for issue #​1545 and stabilize G117 TOML test dependency (#​1546)
• eba2d15 taint: skip context.Context arguments during taint propagation to fix false positives (#​1543)
• a6381c1 test: add missing rules to formatter report tests (#​1540)
• fea9725 chore(deps): update all dependencies (#​1541)
• f3e2fac Regenrate the TLS config rule (#​1539)
• 200461f Improve documentation (#​1538)
• 078a62a Expand analyzer-core test coverage for orchestration, go/analysis adapter logic, and taint integration (#​1537)
• ffdc620 Add unit tests for CLI orchestration, TLS config generation, and SSA cache behavior (#​1536)
• c13a486 Add G707 taint analyzer for SMTP command/header injection (#​1535)
• f61ed31 Add G123 analyzer for tls.VerifyPeerCertificate resumption bypass risk (#​1534)
• b568aa1 Add G122 SSA analyzer for filepath.Walk/WalkDir symlink TOCTOU race risks (#​1532)
• 1735e5a fix(G602): avoid false positives for range-over-array indexing (#​1531)
• caf93d0 Improve taint analyzer performance with shared SSA cache, parallel analyzer execution, and CI regression guard (#​1530)
• bd11fbe fix: taint analysis false positives with G703,G705 (#​1522)
• e34e8dd Extend the G117 rule to cover other types of serialization such as yaml/xml/toml (#​1529)
• b940702 Fix the G117 rule to take the JSON serialization into account (#​1528)
• 4f84627 (docs) fix justification format (#​1524)
• 36ba72b Add G121 analyzer for unsafe CORS bypass patterns in CrossOriginProtection (#​1521)
• 238f982 Add G120 SSA analyzer for unbounded form parsing in HTTP handlers (#​1520)
• 89cde27 Add G119 analyzer for unsafe redirect header propagation in CheckRedirect callbacks (#​1519)
• 14fdd9c Fix G115 false positives and negatives (Issue #​1501) (#​1518)
• cec54ec chore(deps): update all dependencies (#​1517)
• 2b2077e Add G118 SSA analyzer for context propagation failures that can cause goroutine/resource leaks (#​1516)
• a7666f3 Add G113: Detect HTTP Request Smuggling via conflicting headers (CVE-2025-22891, CWE-444) (#​1515)
• 47f8b52 Add G408: SSH PublicKeyCallback Authentication Bypass Analyzer (#​1513)
• 4f1f362 Add more unit tests to improve coverage (#​1512)
• 9344582 Improve test coverage in various areas (#​1511)
• 8d1b2c6 Imprve the test coverage (#​1510)
• 993c1c4 Fix incorrect detection of fixed iv in G407 (#​1509)
• 8668b74 Add support for go 1.26.x and removed support for go 1.24.x (#​1508)
• 514225c Fix the sonar report to follow the latest schema (#​1507)
• 000384e fix: broken taint analysis causing false positives (#​1506)
• 616192c fix: panic on float constants in overflow analyzer (#​1505)
• 79956a3 fix: panic when scanning multi-module repos from root (#​1504)
• 5736e8b fix: G602 false positive for array element access (#​1499)
• 1b7e1e9 Update gosec to version v2.23.0 in the Github action (#​1496)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.