[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/download-artifact	action	patch	v8.0.1 → v8.0.2
actions/upload-artifact	action	patch	v7.0.1 → v7.0.2
knu/lockfile-maintenance-action	action	patch	v2.1.0 → v2.1.1
step-security/harden-runner	action	minor	v2.21.1 → v2.22.1

---

Release Notes

actions/download-artifact

v8.0.2

Compare Source

What's Changed

• Update the readme by @​danwkennedy in #​473
• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Update @​actions/artifact to 6.3.1 by @​tunc-d in #​492
• Prepare download-artifact v8.0.2 by @​tunc-d in #​493

New Contributors

• @​tunc-d made their first contribution in #​492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

actions/upload-artifact

v7.0.2

Compare Source

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in #​821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

knu/lockfile-maintenance-action

v2.1.1

Compare Source

• Fix rebase checkboxes that immediately revert when a PR contains release histories with HTML lists.
• Show a checkbox or /lockfile rebase instructions based on the repository's rebase configuration. Link to setup when neither method is configured or the configuration cannot be verified.
• Place rebase guidance below the version tables for separate histories, or after the opening explanation for inline histories. Keep setup instructions collapsed at the end of the PR and link to them from the guidance.
• Update smol-toml to 1.9.0 to fix excessive parsing time for large TOML files (GHSA-r4xh-jqrq-34v2).

Use knu/lockfile-maintenance-action@v2.1.1 for the composite Action or knu/lockfile-maintenance-action/.github/workflows/maintenance.yml@v2.1.1 for the reusable workflow. Use @v2 to follow the latest main commit that passes CI.

Full changelog

step-security/harden-runner

v2.22.1

Compare Source

What's Changed

• Fixed security rules not initializing on GHES self-hosted runners
• Fixed GHES connectivity in block mode by implicitly allowing the GHES hostname

Full Changelog: step-security/harden-runner@v2.22.0...v2.22.1

v2.22.0

Compare Source

What's Changed

• Linux ARM64 support for community tier
• GHES support for self-hosted VMs (enterprise tier)
• MacOS and Windows runner deny list support for block policy (enterprise tier).

Full Changelog: step-security/harden-runner@v2.21.1...v2.22.0

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • "after 9am on friday,before 6pm on friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-10-18 12:48 UTC · Rule: dependency-updates · triggered by merge protections
• ✅ Checks passed · on draft merge queue: checking #47 + #46 together on main (a03a11f) #48
• ✅ Merged — 2026-10-18 13:01 UTC · at 5caab9485412c02df8a3bb5f43606756be4e953c · merge-batch via merge queue: checking #47 + #46 together on main (a03a11f) #48

This pull request spent 12 minutes 12 seconds in the queue, including 51 seconds running CI.

Required conditions to merge

• #approved-reviews-by >= 1
  • Update github actions #46
  • Lockfile maintenance #47
• github-review-approved [🛡 GitHub repository ruleset rule main]
  • Update github actions #46
  • Lockfile maintenance #47
• any of [🛡 GitHub repository ruleset rule main]:
  • check-success = @github-actions/Test
  • check-neutral = @github-actions/Test
  • check-skipped = @github-actions/Test