Update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
TypedDevs/bashunit	action	minor	0.49.0 → 0.50.1
github/codeql-action	action	patch	v4.37.7 → v4.37.9
metcalfc/changelog-generator	action	minor	v4.8.0 → v4.9.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

TypedDevs/bashunit (TypedDevs/bashunit)

v0.50.1

Compare Source

Fixed

• tear_down_after_script runs when set_up_before_script fails, so it can release file-scoped resources acquired before the failure (#​1318)
• Under --parallel, tear_down_after_script runs after the file's own tests instead of alongside them, so a fixture it releases stays alive for the tests that read it. The same file no longer passed sequentially and failed in parallel (#​1320)
• --stop-on-failure runs tear_down_after_script for the file it halts in, so a sequential run releases what set_up_before_script acquired before the halt (#​1321)
• bashunit bench runs tear_down_after_script before it aborts on a malformed annotation, so the file releases what set_up_before_script acquired (#​1322)
• Ctrl-C runs tear_down_after_script for the file it interrupts in a sequential run, so a file-scoped resource is released. A second Ctrl-C now ends the run even if that hook never returns (#​1323)
• A test killed by --test-timeout runs its tear_down, so a per-test resource is released. Best effort within the watchdog's grace before it sends SIGKILL, so a hook cannot outlive the timeout it cleans up after (#​1324)
• A test file that fails to source sweeps its script temp files, so a bashunit::temp_file it created at top level no longer survives the run. bashunit bench already did this (#​1325)
• A malformed @timeout or @retry runs tear_down_after_script before it aborts the run, so the file releases what set_up_before_script acquired. Sequential and --parallel both leaked it (#​1329)
• Ctrl-C releases what an interrupted --parallel run acquired: the file's tear_down_after_script and the tear_down of a test in flight. The worker that owns the file's hook now handles the signal and reaches its test bodies, which a kill from the parent could not (#​1331)
• A malformed @timeout or @retry fails a --parallel run alongside a passing file. The abort happened inside the file's worker and never reached the parent, so the run printed the error and still exited 0, which kept it out of CI (#​1335)

v0.50.0

Compare Source

Added

• -u as the short form of --snapshot-update, the spelling jest and vitest both use (#​1293)

Changed

• --seed <n> now implies --random-order. Replaying a failure with the seed the header printed used to select nothing, so the run came back in defined order and green. An order named explicitly still wins, as in RSpec (#​1287)
• Performance: cold start is about 9ms faster, roughly 15%. The colour palette cost one subshell fork per colour, and every invocation paid it — --version included (#​1285)
• Performance: a --parallel run writing a report is about 1.9x faster and uses 1.8x less CPU. Each result row cost fourteen base64 forks per test, so --log-junit cost several times more than running the tests (#​1289)

Fixed

• --output json and --output junit are no longer corrupted by console text on stdout, which left the document unparseable. Four sources: an empty --parallel selection (#​1295), the blank line after a tear_down_after_script (#​1297), the duplicate-function abort, and a --parallel worker's stderr replay (#​1299)
• --parallel reports no longer count a file-level hook failure twice. JSON, JUnit, HTML and Markdown listed it as two failed tests while the console summary of the same run said one (#​1301)
• bashunit bench exits non-zero when a benchmark file fails to source or its set_up_before_script fails. It printed the error and exited 0, so the failure never reached CI, and a syntax error silently dropped every bench_ function after it (#​1303)
• --output tap escapes # in a test description, as --report-tap already did. A failing test titled ... # SKIP ... reached the consumer as a skip and left CI silently (#​1309)
• bashunit watch no longer takes an option's value as the path it polls: watch --tag slow tests/ polled a directory named slow. Options may now appear in any position (#​1291)
• The JUnit report escapes the file path; a name holding ", & or < closed the attribute early and the document stopped parsing (#​1313)
• The Cobertura report escapes XML metacharacters in a path, so GitLab, Azure and Jenkins render coverage instead of silently showing nothing (#​1311)
• GitHub Actions annotations encode : and , in their property values; a comma in a test title ended the title there and invented a property (#​1307)
• A ``` fence in a failure message no longer truncates the --report-md summary, which is appended to $GITHUB_STEP_SUMMARY (#​1305)

Security

• A test file's path is no longer evaluated as shell. The per-test EXIT trap interpolated the path into the trap string, and a trap body is re-evaluated when it fires, so a filename holding a command substitution executed it — reachable by any run over a tree whose filenames someone else controls, which is what CI does with a checked-out branch. The same mangling meant such a file's assertions never ran and it was reported risky instead of failing (#​1315)

Removed

• bashunit learn, the interactive tutorial. Nobody used it, and it was broken for most of the nine months it shipped without anyone reporting it. Learning bashunit belongs in the docs at https://bashunit.com, not in a subsystem inside the runner — which is also 6% of the distributable. Calling it now says it was removed and points there (#​1256, #​1258)

github/codeql-action (github/codeql-action)

v4.37.9

Compare Source

• Update default CodeQL bundle version to 2.26.4. #​4106

v4.37.8

Compare Source

No user facing changes.

metcalfc/changelog-generator (metcalfc/changelog-generator)

v4.9.1

Compare Source

Patch release for the v4 line

Documentation and CI only. dist/ is byte-identical to
v4.9.0,
so there is no functional change for consumers; this release exists so the v4
tag points at a commit whose docs are correct.

• Return the modified changelog as a real multiline output (#​478)

The README's "Simple output modifications" recipe percent-encoded newlines as
%0A, which the long-removed ::set-output command decoded. $GITHUB_OUTPUT
does not, so anyone who copied that snippet got a single line with literal
%0A in it. It now uses the heredoc form, with a random delimiter because the
value is built from commit subjects.

The changelog output format remains unchanged from v4.8.0. See
v5.0.0
for the breaking change that renders commit subjects as literal text.

v4.9.0

Compare Source

Maintenance release for the v4 line

Security and dependency fixes only. The changelog output format is unchanged
from v4.8.0 -- verified byte-identical -- so tracking @v4 is safe.

• undici 7.29.0, closing all 12 open advisories (4 high)
• release-workflow hardening: tag names no longer reach a shell as source, and
  the published bundle is now verified against a rebuild before attestation
• @vercel/ncc 0.45.0 and dev-dependency bumps

v5.0.0
contains these same fixes plus a breaking change: commit subjects render as
literal text, so a merged pull request's subject can no longer inject links or
mentions into your release notes. That change also stops #123 autolinking
inside subjects, which is why it is not on the v4 line.

---

• 8b3d973 - 4.9.0
• ab3e266 - fix: carry the bump:workflow provenance fix onto the v4 line
• f6a78ba - release: prepare the v4 maintenance line
• 8becfce - fix(deps): bound the dependency overrides and clear the undici advisories (#​476)
• f723555 - build(deps-dev): bump @​vercel/ncc from 0.44.1 to 0.45.0 (#​470)
• 88097f8 - build(deps-dev): bump eslint from 10.8.1 to 10.9.0 (#​472)
• 430ccb9 - build(deps-dev): bump globals from 17.9.0 to 17.11.0 (#​471)
• d40422b - build(deps): bump the codeql-action group with 3 updates (#​469)
• ba35f7d - Verify release bundle before attestation (#​474)
• 91ac6bb - Render changelog subjects as literal text (#​475)
• c2ec39e - Keep release tag names out of shell source (#​473)
• b28b10d - ci: let the stale workflow be run on demand (#​467)
• d255efb - build(deps): bump actions/setup-node from 6.5.0 to 7.0.0 (#​463)
• 20397cc - build(deps): bump actions/checkout from 6.0.2 to 7.0.1 (#​450)
• 67da1d3 - build(deps): bump actions/stale from 10.2.0 to 11.0.0 (#​462)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.