Update GitHub 操作

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Pending	Age	Confidence
anthropics/claude-code-action	action	patch	v1.0.119 → v1.0.191	v1.0.207 (+15)
bun (source)	uses-with	patch	1.3.13 → 1.3.14	1.4.0
github/codeql-action	action	minor	v4.35.2 → v4.37.7	v4.37.9 (+1)
marocchino/sticky-pull-request-comment	action	patch	v3.0.4 → v3.0.5
ossf/scorecard-action	action	patch	v2.4.3 → v2.4.4
trufflesecurity/trufflehog	action	minor	v3.95.2 → v3.96.0	v3.97.1 (+1)

---

Release Notes

anthropics/claude-code-action (anthropics/claude-code-action)

v1.0.191

比较 Source

Full Changelog: anthropics/claude-code-action@v1.0.190...v1.0.191

v1.0.190

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.190

v1.0.189

比较 Source

v1.0.188

比较 Source

v1.0.187

比较 Source

What's Changed

• Redact common credential patterns from published run output by @​ashwin-ant in #​1595
• Scope the config snapshot to files inside the working tree by @​ashwin-ant in #​1596
• Run checkout auth cleanup when API commit signing is enabled by @​ashwin-ant in #​1597

Full Changelog: anthropics/claude-code-action@v1...v1.0.187

v1.0.186

比较 Source

v1.0.185

比较 Source

What's Changed

• Derive trigger timestamps for issues and pull_request events by @​ashwin-ant in #​1592
• Pin bun config for MCP server processes by @​ashwin-ant in #​1589
• Match downloaded images to their source URLs by asset identifier by @​ashwin-ant in #​1588
• Check collaborator permissions for workflow_run events by @​ashwin-ant in #​1590

Full Changelog: anthropics/claude-code-action@v1...v1.0.185

v1.0.184

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.184

v1.0.183

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.183

v1.0.182

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.182

v1.0.181

比较 Source

v1.0.180

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.180

v1.0.179

比较 Source

v1.0.178

比较 Source

v1.0.177

比较 Source

v1.0.176

比较 Source

v1.0.175

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.175

v1.0.174

比较 Source

What's Changed

• fix(sanitizer): redact GitHub user-to-server (ghu_) tokens by @​NickNojiri in #​1502

新建 贡献者

• @​NickNojiri made their first contribution in #​1502

Full Changelog: anthropics/claude-code-action@v1...v1.0.174

v1.0.173

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.173

v1.0.172

比较 Source

What's Changed

• fix(sdk): fail step when result has is_error:true despite success subtype by @​syf2211 in #​1496

Full Changelog: anthropics/claude-code-action@v1...v1.0.172

v1.0.171

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.171

v1.0.170

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.170

v1.0.169

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.169

v1.0.168

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.168

v1.0.167

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.167

v1.0.166

比较 Source

What's Changed

• Drop buffered inline comment when it is posted live (#​1405) by @​archievi in #​1412
• Use modern noreply email for co-author trailers by @​tarunag10 in #​1369
• fix(restore): handle symlinked CLAUDE.md paths during config snapshot by @​syf2211 in #​1441
• fix: preserve repeated add-dir flags in claude args by @​Jerry2003826 in #​1256
• fix: propagate curl failures in install pipeline by @​akhilesharora in #​1241
• chore: fix prettier formatting by @​ashwin-ant in #​1463

新建 贡献者

• @​archievi made their first contribution in #​1412
• @​syf2211 made their first contribution in #​1441
• @​akhilesharora made their first contribution in #​1241

Full Changelog: anthropics/claude-code-action@v1...v1.0.166

v1.0.165

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.165

v1.0.164

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.164

v1.0.163

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.163

v1.0.162

比较 Source

v1.0.161

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.161

v1.0.160

比较 Source

v1.0.159

比较 Source

What's Changed

• fix: bound app token revocation cleanup by @​tarunag10 in #​1437

新建 贡献者

• @​tarunag10 made their first contribution in #​1437

Full Changelog: anthropics/claude-code-action@v1...v1.0.159

v1.0.158

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.158

v1.0.157

比较 Source

v1.0.156

比较 Source

v1.0.155

比较 Source

v1.0.154

比较 Source

v1.0.153

比较 Source

v1.0.152

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.152

v1.0.151

比较 Source

What's Changed

• fix: skip workflow validation token exchange failures by @​Ryanoonan in #​1417

新建 贡献者

• @​Ryanoonan made their first contribution in #​1417

Full Changelog: anthropics/claude-code-action@v1...v1.0.151

v1.0.150

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.150

v1.0.149

比较 Source

What's Changed

• fix(parse-sdk-options): prevent shell-quote from collapsing unquoted Bash(X:*) rules to bare Bash by @​alexglynn in #​1350
• fix(mcp): align allowed-tools parser with SDK option parser by @​bymle in #​1373

新建 贡献者

• @​alexglynn made their first contribution in #​1350

Full Changelog: anthropics/claude-code-action@v1...v1.0.149

v1.0.148

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.148

v1.0.147

比较 Source

What's Changed

• Add pr-stamp-sweep review workflow by @​ashwin-ant in #​1409

Full Changelog: anthropics/claude-code-action@v1...v1.0.147

v1.0.146

比较 Source

What's Changed

• test: add unit tests for parseGitHubContext and context type guards by @​mateuscmtropical in #​1404
• docs(faq): correct rebase FAQ to match actual behavior by @​bymle in #​1370
• fix: fall back to inherited env for auth when inputs are empty by @​kirsanium in #​1342
• fix: break SDK iterator after result message to prevent hang in pull_request runs by @​scobbe in #​1339
• Pin setup-bun binary for post-steps by @​kiwigitops in #​1365
• fix: clear stale claude-prompts dir before each write by @​kyungilpark in #​1288
• Include labels in formatContext() output for issues and PRs by @​joshpayne-joby in #​1298
• fix(sanitizer): match attribute quotes by type to avoid mangling content by @​bymle in #​1371
• docs: fix execution file parsing example by @​looooown2006 in #​1297
• fix(image-downloader): detect image type from magic bytes, not URL extension by @​pmespresso in #​1396

新建 贡献者

• @​mateuscmtropical made their first contribution in #​1404
• @​bymle made their first contribution in #​1370
• @​kirsanium made their first contribution in #​1342
• @​scobbe made their first contribution in #​1339
• @​kiwigitops made their first contribution in #​1365
• @​kyungilpark made their first contribution in #​1288
• @​joshpayne-joby made their first contribution in #​1298
• @​looooown2006 made their first contribution in #​1297
• @​pmespresso made their first contribution in #​1396

Full Changelog: anthropics/claude-code-action@v1...v1.0.146

v1.0.145

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.145

v1.0.144

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.144

v1.0.143

比较 Source

What's Changed

• Drop --tsconfig-override from Bun invocations to avoid runtime crash by @​chsmc-ant in #​1315

新建 贡献者

• @​chsmc-ant made their first contribution in #​1315

Full Changelog: anthropics/claude-code-action@v1...v1.0.143

v1.0.142

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.142

v1.0.141

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.141

v1.0.140

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.140

v1.0.139

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.139

v1.0.138

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.138

v1.0.137

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.137

v1.0.136

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.136

v1.0.135

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.135

v1.0.134

比较 Source

What's Changed

• Add workload identity federation support to base-action by @​ashwin-ant in #​1378
• chore: bump actions/setup-node from v4.4.0 to v6.4.0 (Node.js 24) by @​ant-kurt in #​1377
• ci: bump checkout and setup-bun in test workflows to Node 24 releases by @​ant-kurt in #​1379

新建 贡献者

• @​ant-kurt made their first contribution in #​1377

Full Changelog: anthropics/claude-code-action@v1...v1.0.134

v1.0.133

比较 Source

What's Changed

• Use workload identity federation for Claude auth in CI workflows by @​ashwin-ant in #​1344

Full Changelog: anthropics/claude-code-action@v1...v1.0.133

v1.0.132

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.132

v1.0.131

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.131

v1.0.130

比较 Source

What's Changed

• Add Workload Identity Federation (OIDC) authentication support by @​ashwin-ant in #​1338

Full Changelog: anthropics/claude-code-action@v1...v1.0.130

v1.0.129

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.129

v1.0.128

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.128

v1.0.127

比较 Source

What's Changed

• Refactor allowed_bots actor resolution by @​ashwin-ant in #​1330

Full Changelog: anthropics/claude-code-action@v1...v1.0.127

v1.0.126

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.126

v1.0.125

比较 Source

What's Changed

• Simplify comment tool instructions in prompt by @​ashwin-ant in #​1328

Full Changelog: anthropics/claude-code-action@v1...v1.0.125

v1.0.124

比较 Source

What's Changed

• fix: add parentheses to fix operator precedence in co-author check by @​FuturizeRush in #​1199
• Strengthen simplified tag-mode prompt (USE_SIMPLE_PROMPT) by @​ashwin-ant in #​1313
• Fix prettier formatting in create-prompt by @​ashwin-ant in #​1325

新建 贡献者

• @​FuturizeRush made their first contribution in #​1199

Full Changelog: anthropics/claude-code-action@v1...v1.0.124

v1.0.123

比较 Source

What's Changed

• fix: allow , in branch names by @​bugbubug in #​1310
• fix: dereference symlinks when snapshotting sensitive paths to .claude-pr/ by @​matanbaruch in #​1186
• fix: exclude .claude-pr snapshot from git staging by @​cvan20191 in #​1277
• fix: write execution file when SDK throws by @​Jerry2003826 in #​1255
• fix: handle non-user actors (e.g. Copilot) in permission and actor checks by @​krislavten in #​1144
• chore: bump pinned Bun to 1.3.14 by @​ashwin-ant in #​1312

新建 贡献者

• @​bugbubug made their first contribution in #​1310
• @​matanbaruch made their first contribution in #​1186
• @​cvan20191 made their first contribution in #​1277
• @​Jerry2003826 made their first contribution in #​1255
• @​krislavten made their first contribution in #​1144

Full Changelog: anthropics/claude-code-action@v1...v1.0.123

v1.0.122

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.122

v1.0.121

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.121

v1.0.120

比较 Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.120

oven-sh/bun (bun)

v1.3.14: Bun v1.3.14

比较 Source

To install Bun v1.3.14

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.14:

bun upgrade

Read Bun v1.3.14's release notes on Bun's blog

Thanks to 11 contributors!

• @​190n
• @​alii
• @​carlsmedstad
• @​cirospaciari
• @​coleleavitt
• @​djs5008
• @​dylan-conway
• @​ig-ant
• @​Jarred-Sumner
• @​robobun
• @​sosukesuzuki

github/codeql-action (github/codeql-action)

v4.37.7

比较 Source

• Update default CodeQL bundle version to 2.26.3. #​4085

v4.37.6

比较 Source

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #​4070

v4.37.5

比较 Source

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #​4061

v4.37.4

比较 Source

v4.37.3

比较 Source

No user facing changes.

v4.37.2

比较 Source

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #​4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #​4007

v4.37.1

比较 Source

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #​3956
• Update default CodeQL bundle version to 2.26.1. #​4019

v4.37.0

比较 Source

• Update default CodeQL bundle version to 2.26.0. #​3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #​3973

v4.36.3

比较 Source

No user facing changes.

v4.36.2

比较 Source

• Cache CodeQL CLI version information across 操作 steps. #​3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #​3937
• Update default CodeQL bundle version to 2.25.6. #​3948

v4.36.1

比较 Source

No user facing changes.

v4.36.0

比较 Source

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #​3894
• Add support for SHA-256 Git object IDs. #​3893
• Update default CodeQL bundle version to 2.25.5. #​3926

v4.35.5

比较 Source

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #​3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #​3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #​3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #​3880

v4.35.4

比较 Source

• Update default CodeQL bundle version to 2.25.4. #​3881

v4.35.3

比较 Source

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #​3837
• Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #​3850
• Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #​3853
• Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #​3852
• Update default CodeQL bundle version to 2.25.3. #​3865

marocchino/sticky-pull-request-comment (marocchino/sticky-pull-request-comment)

v3.0.5

比较 Source

ossf/scorecard-action (ossf/scorecard-action)

v2.4.4

比较 Source

What's Changed

This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the Scorecard v5.4.0 release notes and the Scorecard v5.5.0 release notes.

• log POST failures instead of failing entire action by @​spencerschrock in #​1625

Full Changelog: ossf/scorecard-action@v2.4.3...v2.4.4

trufflesecurity/trufflehog (trufflesecurity/trufflehog)

v3.96.0

比较 Source

What's Changed

• [INS-355] Added Hashicorp vault token detector by @​MuneebUllahKhan222 in #​4819
• Tighten JiraToken v1 verification by @​shahzadhaider1 in #​5122
• [INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @​bill-rich in #​5123
• Fix GitLab project metadata cache and switch to LRU by @​kashifkhan0771 in #​4727
• Log analyze errors for Anthropic Analyzer by @​kashifkhan0771 in #​5120
• Add metrics for chunks and results by @​mcastorina in #​5128
• Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @​kashifkhan0771 in #​5111
• [INS-312] Duo API Secret Key Detector by @​MuneebUllahKhan222 in #​4771
• [Feature] Added SonarQube Cloud "Scoped 组织 Token" Detector by @​nabeelalam in #​4739
• [INS-255] Updated datadog detector to set verificationError in case of a verification error by @​MuneebUllahKhan222 in #​4661
• Log analyze errors for Postgres analyzer by @​kashifkhan0771 in #​5131
• Log analyze errors for HuggingFace analyzer by @​kashifkhan0771 in #​5130
• Engine - Config.SourceManager doc by @​amanfcp in #​5002
• Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @​renovate[bot] in #​5034
• Retry git clone on transient network errors by @​shahzadhaider1 in #​5132
• Fix scan_all_installations Rejecting Org Member Personal Repos by @​shahzadhaider1 in #​5142
• updated detector to include underscore char by @​mattbrady-1 in #​5121
• [chore] Change job_id in metric to source_type by @​mcastorina in #​5149
• Posthog regex update by @​mattbrady-1 in #​5133
• fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @​johannestaas-trufflesec in #​5151

新建 贡献者

• @​mattbrady-1 made their first contribution in #​5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

v3.95.9

比较 Source

What's Changed

• feat: add OpenRouter detector by @​McPatate in #​4500
• Integrations fully codeowns detectors by @​trufflesteeeve in #​5104
• [INS-332] Add 新建 Relic 洞察 Insert key detector by @​mustansir14 in #​4778
• [INS-351] Added Duffel Token Detector by @​MuneebUllahKhan222 in #​4795
• [INS-341] Added Shippo detector by @​MuneebUllahKhan222 in #​4820
• [INS-467] Add IPinfo detector to default detectors list by @​mustansir14 in #​4970
• fix: reject --include-repos/--exclude-repos with --repo in github scan by @​kashifkhan0771 in #​5112
• [INS-468] Add improved lob detector to defaults.go by [@​mustansir14]

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	操作	Updated (UTC)
vortex	Ready	Preview	Aug 27, 2026 2:50pm

[github-actions]

🔦 Lighthouse audit

URL	Perf	A11y	Best practices	SEO	Report
/	🟢 94	🟢 100	🟢 96	🟢 100	report
/blog	🟢 100	🟢 100	🟢 96	🟢 100	report
/blog/btrblocks-compressor	🟢 100	🟢 96	🟢 96	🟢 100	report

Run 32322432870 · 2026-08-20 01:51 UTC