[renovate]

This PR contains the following updates:

Package	Type	Update	Change
SonarSource/ci-github-actions	action	major	v1 → v2
actions/cache	action	major	v5.0.5 → v6.1.0
actions/checkout	action	major	v6.0.2 → v7.0.1
step-security/mise-action	action	major	v4.0.1 → v5.1.2

---

Release Notes

SonarSource/ci-github-actions

v2

Compare Source

actions/cache

v6.1.0

Compare Source

What's Changed

• Bump @​actions/cache to v6.1.0 - handle read-only cache access by @​jasongin in #​1768

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

Compare Source

What's Changed

• Update packages, migrate to ESM by @​Samirat in #​1760

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

Compare Source

What's Changed

• Bump @​actions/cache to v5.1.0 - handle read-only cache access by @​jasongin in #​1775

Full Changelog: actions/cache@v5...v5.1.0

actions/checkout

v7.0.1

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Various dependency updates

v6.1.0

Compare Source

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in #​2500
• backport fixes to releases-v6 by @​aiqiaoy in #​2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

step-security/mise-action

v5.1.2

Compare Source

What's Changed

• chore(deps): bump actions/dependency-review-action from 67d4f4b to 1e966ba by @​dependabot[bot] in #​226
• chore(deps): bump github/codeql-action/init from 3.28.16 to 4.37.9 by @​dependabot[bot] in #​225
• fix: Security updates by @​github-actions[bot] in #​228
• fix: Security updates by @​github-actions[bot] in #​232
• chore(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.4 by @​dependabot[bot] in #​224
• fix: Security updates by @​github-actions[bot] in #​235
• chore: Cherry-pick changes from upstream by @​anurag-stepsecurity in #​234
• chore: sync with upstream v5.1.2 by @​anurag-stepsecurity in #​240
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​229
• chore: add dev deps to ignore them by @​anurag-stepsecurity in #​241

Full Changelog: step-security/mise-action@v4.2.4...v5.1.2

v5

Compare Source

v4.2.4

Compare Source

What's Changed

• chore(deps): bump actions/checkout from 4.2.2 to 7.0.1 by @​dependabot[bot] in #​118
• chore(deps): bump step-security/harden-runner from 2.12.0 to 2.20.1 by @​dependabot[bot] in #​140
• fix: Security updates by @​github-actions[bot] in #​222
• chore: Cherry-pick changes from upstream by @​anurag-stepsecurity in #​221
• [StepSecurity] ci: Harden GitHub Actions by @​step-security-bot in #​227

Full Changelog: step-security/mise-action@v4.2.0...v4.2.4

v4.2.0

Compare Source

What's Changed

• chore: Remove guarddog.yml by @​anurag-stepsecurity in #​209
• fix: Security updates by @​github-actions[bot] in #​210
• fix: Security updates by @​github-actions[bot] in #​211
• [StepSecurity] Apply security best practices by @​step-security-bot in #​213
• fix: Security updates by @​github-actions[bot] in #​214
• fix: Security updates by @​github-actions[bot] in #​215
• chore: Cherry-picked changes from upstream by @​anurag-stepsecurity in #​218
• [StepSecurity] ci: Harden GitHub Actions by @​step-security-bot in #​219

New Contributors

• @​anurag-stepsecurity made their first contribution in #​209

Full Changelog: step-security/mise-action@v4...v4.2.0

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • "after 7am every weekday,before 8pm every weekday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[datadog-sonarsource]

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 12 Pipeline jobs failed

Test | All Tests — 🔄 Retry may pass, looks flaky

View more details · View in GitHub Actions

Test | test-cache-metrics-output

View more details · View in GitHub Actions

Test | test-cache-metrics-runner-hook

View more details · View in GitHub Actions

View all 12 failed jobs.

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 0501922 | Docs | View more details | Give us feedback!}

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: BUILD-13271

[sonarqube-cloud-us]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud