build(deps): bump the actions-updates group across 1 directory with 4 updates

[dependabot]

Bumps the actions-updates group with 4 updates in the / directory: actions/setup-node, actions/dependency-review-action, aws-actions/amazon-ecs-render-task-definition and aws-actions/amazon-ecs-deploy-task-definition.

Updates actions/setup-node from 6.2.0 to 6.3.0

Release notes

Sourced from actions/setup-node's releases.

v6.3.0

What's Changed

Enhancements:

• Support parsing devEngines field by @​susnux in actions/setup-node#1283

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

• Fix npm audit issues by @​gowridurgad in actions/setup-node#1491
• Replace uuid with crypto.randomUUID() by @​trivikr in actions/setup-node#1378
• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in actions/setup-node#1498

Bug fixes:

• Remove hardcoded bearer for mirror-url @​marco-ippolito in actions/setup-node#1467
• Scope test lockfiles by package manager and update cache tests by @​gowridurgad in actions/setup-node#1495

New Contributors

• @​susnux made their first contribution in actions/setup-node#1283

Full Changelog: actions/setup-node@v6...v6.3.0

Commits

• 53b8394 Bump minimatch from 3.1.2 to 3.1.5 (#1498)
• 54045ab Scope test lockfiles by package manager and update cache tests (#1495)
• c882bff Replace uuid with crypto.randomUUID() (#1378)
• 774c1d6 feat(node-version-file): support parsing devEngines field (#1283)
• efcb663 fix: remove hardcoded bearer (#1467)
• d02c89d Fix npm audit issues (#1491)
• See full diff in compare view

Updates actions/dependency-review-action from 4.8.2 to 4.9.0

Release notes

Sourced from actions/dependency-review-action's releases.

Dependency Review Action 4.9.0

This feature release contains a couple of notable changes:

• There is a new configuration option show_patched_versions which will add a column to the output, showing the fix version of each vulnerable dependency. Thanks @​felickz!
• Runs which do not display OpenSSF scorecards no longer fetch scorecard information; previously it was fetched regardless of whether or not it was displayed, causing unneccessary slowness. Great catch @​jantiebot!
• There are a couple of fixes to purl parsing which should improve match accuracy for allow-package-dependency lists, including case (in)sensitivity and url-encoded namespaces Thanks @​juxtin!

What's Changed

• Compare normalized purls to account for encoding quirks by @​juxtin in actions/dependency-review-action#1056
• Make purl comparisons case insensitive by @​juxtin in actions/dependency-review-action#1057
• Feat: Add Patched Version to Vulnerabilities summary by @​felickz in actions/dependency-review-action#1045
• fix: only get scorecard levels if user wants to see the OpenSSF scorecard by @​jantiebot in actions/dependency-review-action#1060
• Bump actions/stale from 10.1.0 to 10.2.0 by @​dependabot[bot] in actions/dependency-review-action#1058
• Bump actions/checkout from 4 to 6 by @​dependabot[bot] in actions/dependency-review-action#1021
• Updates for release 4.9.0 by @​ahpook in actions/dependency-review-action#1064

New Contributors

• @​jantiebot made their first contribution in actions/dependency-review-action#1060

Full Changelog: actions/dependency-review-action@v4.8.3...v4.9.0

4.8.3

Dependency Review Action v4.8.3

This is a bugfix release that updates a number of upstream dependencies and includes a fix for the earlier feature that detected oversized summaries and upload them as artifacts, which could occasionally crash the action.

We have also updated the release process to use a long-lived v4 branch for the action, instead of a force-pushed tag, which aligns better with git branching strategies; the change should be transparent to end users.

What's Changed

• GitHub Actions can't push to our protected main by @​dangoor in actions/dependency-review-action#1017
• Bump actions/stale from 9.1.0 to 10.1.0 by @​dependabot[bot] in actions/dependency-review-action#995
• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in actions/dependency-review-action#1003
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in actions/dependency-review-action#1005
• Upgrade glob to address a vulnerability by @​brrygrdn in actions/dependency-review-action#1024
• Bump js-yaml by @​dependabot[bot] in actions/dependency-review-action#1020
• Addressing vulnerabilities by @​Ahmed3lmallah in actions/dependency-review-action#1036
• Bump fast-xml-parser from 5.3.3 to 5.3.5 by @​dependabot[bot] in actions/dependency-review-action#1050
• Bump fast-xml-parser from 5.3.5 to 5.3.6 by @​dependabot[bot] in actions/dependency-review-action#1053
• Properly truncate long summaries and catch errors by @​juxtin in actions/dependency-review-action#1052
• Bump spdx-expression-parse from 3.0.1 to 4.0.0 in the spdx-licenses group across 1 directory by @​dependabot[bot] in actions/dependency-review-action#931
• Changes for Release 4.8.3 by @​ahpook in actions/dependency-review-action#1054

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.8.2..v4.8.3

Commits

• 2031cfc Merge pull request #1064 from actions/ahpook/release-4.9.0
• d02fa39 Updates for release 4.9.0
• 4038a34 Merge pull request #1021 from actions/dependabot/github_actions/actions/check...
• a632b83 Merge pull request #1058 from actions/dependabot/github_actions/actions/stale...
• 57a3d46 Merge pull request #1060 from jantiebot/main
• 5ecdc4b Merge pull request #1045 from forks-felickz/main
• e8c2f9a fix: remove inferrable type annotation to pass eslint
• 0e129e1 Prettier - Refactor summary table rendering for improved readability
• aa60746 Add 'show-patched-versions' option to configuration and update summary handling
• e404798 Merge upstream actions/dependency-review-action main
• Additional commits viewable in compare view

Updates aws-actions/amazon-ecs-render-task-definition from 1.8.3 to 1.8.4

Release notes

Sourced from aws-actions/amazon-ecs-render-task-definition's releases.

v1.8.4

See the changelog for details about the changes included in this release.

Changelog

Sourced from aws-actions/amazon-ecs-render-task-definition's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

1.8.4 (2026-03-20)

Bug Fixes

• upgrade Node.js runtime from 20 to 24 (#457) (872f52a), closes #454

1.8.3 (2026-01-16)

1.8.2 (2025-12-18)

1.8.1 (2025-10-16)

1.8.0 (2025-08-14)

Features

• add possibility to add more than one container in container-name (#229) (ce1d739)

1.7.5 (2025-08-04)

1.7.4 (2025-06-23)

1.7.3 (2025-05-28)

1.7.2 (2025-04-22)

1.7.1 (2025-03-24)

1.7.0 (2025-03-03)

Features

• get tags and clean attributes (#325) (ac0e284)

1.6.2 (2025-01-14)

1.6.1 (2024-11-26)

1.6.0 (2024-10-23)

Features

... (truncated)

Commits

• 77954e2 chore(release): 1.8.4
• 872f52a fix: upgrade Node.js runtime from 20 to 24 (#457)
• See full diff in compare view

Updates aws-actions/amazon-ecs-deploy-task-definition from 2.6.0 to 2.6.1

Release notes

Sourced from aws-actions/amazon-ecs-deploy-task-definition's releases.

v2.6.1

See the changelog for details about the changes included in this release.

Changelog

Sourced from aws-actions/amazon-ecs-deploy-task-definition's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.6.1 (2026-03-25)

Bug Fixes

• add optional wait-max-delay-seconds input to configure waiter polling (#839) (5fda33a)
• upgrade Node.js runtime to node24 (#852) (8f67c1a)

2.6.0 (2026-01-16)

Features

• Add support for maxAttempts to allow retrying after failure (#750) (ede1821)

2.5.1 (2025-12-18)

2.5.0 (2025-11-24)

Features

• Set url to deployments instead of events (#809) (2b13337)

Bug Fixes

• Slack notifications webhook (#801) (6a4f2b4)

2.4.0 (2025-09-09)

Features

• adding keep-null-value-keys #780 (#781) (635a63a)

2.3.4 (2025-07-24)

Bug Fixes

• dist/index.js (#773) (2aac05b)

2.3.3 (2025-06-16)

2.3.2 (2025-04-14)

... (truncated)

Commits

• fc8fc60 chore(release): 2.6.1
• 8f67c1a fix: upgrade Node.js runtime to node24 (#852)
• c1035d8 chore: Bump undici and @​actions/http-client (#848)
• 921ff16 chore: Bump minimatch from 3.1.2 to 3.1.5 (#844)
• 5fda33a fix: add optional wait-max-delay-seconds input to configure waiter polling (#...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA ec565d2.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/setup-node	53b83947a5a98c8d113130e565377fae1a50d02f	🟢 6	Details Check Score Reason Maintained 🟢 9 11 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 9 Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 9 binaries present in source code Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9

Scanned Files

• .github/workflows/release.yml

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.