Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.
[View this repository on the Mend.io Web Portal](https://developer.mend.io/github/brave/security-action).

## Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

- [ ] chore(deps): update dependency bun to v1.4.2
- [ ] chore(deps): update dependency dotenv to v17.4.2
- [ ] chore(deps): update pnpm to v11.26.0
- [ ] chore(deps): update pnpm/action-setup action to v6.1.0
- [ ] chore(deps): update astral-sh/setup-uv action to v10
- [ ] chore(deps): update pnpm to v12
- [ ] 🔐 **Create all rate-limited PRs at once** 🔐

## Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

- [ ] chore(deps): update actions/checkout action to v5.1.0
- [ ] chore(deps): update dependency @slack/web-api to v7.19.0
- [ ] chore(deps): update dependency fast-check to v4.10.0
- [ ] chore(deps): update dependency ruby to v3.4.10
- [ ] chore(deps): update ruby/setup-ruby action to v1.321.0
- [ ] chore(deps): update actions/checkout action to v7

## Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

- [ ] [chore(deps): update dependency @octokit/core to v7.0.8](../pull/983)
- [ ] [chore(deps): update python to v3.14.7](../pull/949)
- [ ] [chore(deps): update reviewdog/action-setup action to v1.5.0](../pull/843)
- [ ] [fix(deps): update dependency pip-audit to ~=2.10.1](../pull/982)
- [ ] [chore(deps): update dependency brakeman to v8](../pull/974)
- [ ] [chore(deps): update dependency ruby to v4](../pull/975)
- [ ] [fix(deps): update dependency @slack/web-api to v8](../pull/977)
- [ ] [fix(deps): update dependency js-yaml to v5](../pull/979)
- [ ] **Click on this checkbox to rebase all open PRs at once**

## Detected Dependencies

bundler (1)

Gemfile (1)

- `brakeman '6.2.2'` → [Updates: `'8.0.6'`]

github-actions (18)

.github/workflows/full-loop.yml (1)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`

.github/workflows/lint.yml (4)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `pnpm/action-setup v6.0.10@f40ffcd9367d9f12939873eb1018b921a783ffaa` → [Updates: `v6.1.0`, `v6.0.10`]
- `actions/setup-node v7.0.0@820762786026740c76f36085b0efc47a31fe5020`
- `astral-sh/setup-uv v9.0.0@c771a70e6277c0a99b617c7a806ffedaca235ff9` → [Updates: `v10.0.1`]

.github/workflows/loop.yml (1)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`

.github/workflows/opengrep-brave-core.yml (1)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`

.github/workflows/opengrep-self-test.yml (3)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9`
- `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3`

.github/workflows/semgrep-publish.yml (1)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`

.github/workflows/symbolic.yml (5)

- `actions/checkout v5.0.0@08c6903cd8c0fde910a37f88322edcfb5dd907a8` → [Updates: `v5.1.0`, `v7.0.1`]
- `astral-sh/setup-uv v9.0.0@c771a70e6277c0a99b617c7a806ffedaca235ff9` → [Updates: `v10.0.1`]
- `actions/checkout v5.0.0@08c6903cd8c0fde910a37f88322edcfb5dd907a8` → [Updates: `v5.1.0`, `v7.0.1`]
- `oven-sh/setup-bun v2.2.0@0c5077e51419868618aeaa5fe8019c62421857d6`
- `bun 1.4.0` → [Updates: `1.4.2`]

.github/workflows/update-opengrep-version.yml (4)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-node v7.0.0@820762786026740c76f36085b0efc47a31fe5020`
- `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3`
- `node 24.x`

actions/add-maintainer-custom-property/action.yml (3)

- `actions/setup-node v7.0.0@820762786026740c76f36085b0efc47a31fe5020`
- `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3`
- `node 24.x`

actions/add-runtime-custom-property/action.yml (3)

- `actions/setup-node v7.0.0@820762786026740c76f36085b0efc47a31fe5020`
- `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3`
- `node 24.x`

actions/check-new-repos/action.yml (3)

- `actions/setup-node v7.0.0@820762786026740c76f36085b0efc47a31fe5020`
- `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3`
- `node 24.x`

actions/cleanup/action.yml (3)

- `actions/setup-node v7.0.0@820762786026740c76f36085b0efc47a31fe5020`
- `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3`
- `node 24.x`

actions/dependabot-auto-dismiss/action.yml (3)

- `actions/setup-node v7.0.0@820762786026740c76f36085b0efc47a31fe5020`
- `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3`
- `node 24.x`

actions/dependabot-nudge/action.yml (3)

- `actions/setup-node v7.0.0@820762786026740c76f36085b0efc47a31fe5020`
- `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3`
- `node 24.x`

actions/main/action.yml (10)

- `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3`
- `actions/setup-python v7.0.0@5fda3b95a4ea91299a34e894583c3862153e4b97`
- `astral-sh/setup-uv v10.0.1@20cfd1bf945f4377ade1205e4dbc17946fc9a30d` → [Updates: `v10.1.0`]
- `reviewdog/action-setup v1.3.2@e04ffabe3898a0af8d0fb1af00c188831c4b5893` → [Updates: `v1.5.0`]
- `ruby/setup-ruby v1.267.0@d5126b9b3579e429dd52e51e68624dda2e05be25` → [Updates: `v1.321.0`]
- `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9`
- `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3`
- `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3`
- `python 3.12` → [Updates: `3.14`]
- `ruby 3.2` → [Updates: `3.4.10`, `4.0.6`]

actions/older-than-2y/action.yml (3)

- `actions/setup-node v7.0.0@820762786026740c76f36085b0efc47a31fe5020`
- `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3`
- `node 24.x`

actions/opengrep-compare/action.yml (3)

- `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9`
- `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3`
- `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3`

actions/renovate-sanity-check/action.yml (3)

- `actions/setup-node v7.0.0@820762786026740c76f36085b0efc47a31fe5020`
- `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3`
- `node 24.x`

npm (2)

package.json (14)

- `@octokit/core ^7.0.0` → [Updates: `^7.0.0`]
- `@slack/web-api ^7.0.0` → [Updates: `^7.0.0`, `^8.0.0`]
- `@tryfabric/mack ^1.2.1`
- `glob ^13.0.0`
- `js-yaml ^4.3.2` → [Updates: `^5.0.0`]
- `json5 ^2.2.3`
- `markdown-to-txt ^2.0.1`
- `octokit ^5.0.5`
- `@cucumber/cucumber 13.2.1`
- `c8 12.0.0`
- `dotenv 17.3.1` → [Updates: `17.4.2`]
- `fast-check 4.9.0` → [Updates: `4.10.0`]
- `standard 17.1.2`
- `pnpm 11.24.0` → [Updates: `11.26.0`, `12.3.4`]

pnpm-workspace.yaml (2)

- `flatted >=3.4.2`
- `fast-xml-parser >=5.5.7`

pep621 (1)

pyproject.toml (11)

- `python >=3.12,<3.13` → [Updates: `>=3.14,<3.15`]
- `pip-audit ~=2.9.0` → [Updates: `~=2.10.1`]
- `setuptools ~=84.0.0`
- `modelscan ~=0.8`
- `numpy >=1.20`
- `h5py >=3.0`
- `tensorflow >=2.10`
- `pytest >=8`
- `pytest-bdd >=7`
- `pytest-cov >=5`
- `hypothesis >=6`

renovate-config (1)

.github/renovate.json

---

- [ ] Check this box to trigger a request for Renovate to run again on this repository

Read the linked Dependency Dashboard documentation first, then inspect .github/renovate.json and the listed dependency files: Gemfile, package.json, pyproject.toml, and workflow/action files. The issue is a Renovate dashboard with rate-limited, pending, and already-open updates; completion is not defined beyond triggering or handling those dashboard entries.

Written by the indexing model from the issue text.