Update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	patch	v4.37.7 → v4.37.8
metcalfc/changelog-generator	action	minor	v4.8.0 → v4.9.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

github/codeql-action (github/codeql-action)

v4.37.8

Compare Source

No user facing changes.

metcalfc/changelog-generator (metcalfc/changelog-generator)

v4.9.1

Compare Source

Patch release for the v4 line

Documentation and CI only. dist/ is byte-identical to
v4.9.0,
so there is no functional change for consumers; this release exists so the v4
tag points at a commit whose docs are correct.

• Return the modified changelog as a real multiline output (#​478)

The README's "Simple output modifications" recipe percent-encoded newlines as
%0A, which the long-removed ::set-output command decoded. $GITHUB_OUTPUT
does not, so anyone who copied that snippet got a single line with literal
%0A in it. It now uses the heredoc form, with a random delimiter because the
value is built from commit subjects.

The changelog output format remains unchanged from v4.8.0. See
v5.0.0
for the breaking change that renders commit subjects as literal text.

v4.9.0

Compare Source

Maintenance release for the v4 line

Security and dependency fixes only. The changelog output format is unchanged
from v4.8.0 -- verified byte-identical -- so tracking @v4 is safe.

• undici 7.29.0, closing all 12 open advisories (4 high)
• release-workflow hardening: tag names no longer reach a shell as source, and
  the published bundle is now verified against a rebuild before attestation
• @vercel/ncc 0.45.0 and dev-dependency bumps

v5.0.0
contains these same fixes plus a breaking change: commit subjects render as
literal text, so a merged pull request's subject can no longer inject links or
mentions into your release notes. That change also stops #123 autolinking
inside subjects, which is why it is not on the v4 line.

---

• 8b3d973 - 4.9.0
• ab3e266 - fix: carry the bump:workflow provenance fix onto the v4 line
• f6a78ba - release: prepare the v4 maintenance line
• 8becfce - fix(deps): bound the dependency overrides and clear the undici advisories (#​476)
• f723555 - build(deps-dev): bump @​vercel/ncc from 0.44.1 to 0.45.0 (#​470)
• 88097f8 - build(deps-dev): bump eslint from 10.8.1 to 10.9.0 (#​472)
• 430ccb9 - build(deps-dev): bump globals from 17.9.0 to 17.11.0 (#​471)
• d40422b - build(deps): bump the codeql-action group with 3 updates (#​469)
• ba35f7d - Verify release bundle before attestation (#​474)
• 91ac6bb - Render changelog subjects as literal text (#​475)
• c2ec39e - Keep release tag names out of shell source (#​473)
• b28b10d - ci: let the stale workflow be run on demand (#​467)
• d255efb - build(deps): bump actions/setup-node from 6.5.0 to 7.0.0 (#​463)
• 20397cc - build(deps): bump actions/checkout from 6.0.2 to 7.0.1 (#​450)
• 67da1d3 - build(deps): bump actions/stale from 10.2.0 to 11.0.0 (#​462)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.