deps(actions): bump the actions-updates group with 4 updates

[dependabot]

Bumps the actions-updates group with 4 updates: actions/setup-node, davelosert/vitest-coverage-report-action, github/gh-aw and github/gh-aw/actions/setup.

Updates actions/setup-node from 6 to 7

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

• Upgrade @​actions dependencies by @​Copilot in actions/setup-node#1525
• Update Node.js versions in versions.yml and bump package to v6.4.0 by @​priya-kinthali in actions/setup-node#1533

New Contributors

• @​Copilot made their first contribution in actions/setup-node#1525

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

• Support parsing devEngines field by @​susnux in actions/setup-node#1283

... (truncated)

Commits

• 8207627 Migrate to ESM and upgrade dependencies (#1574)
• 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
• 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
• 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
• 30eb73b Resolve high-severity audit issues
• 4e1a87a Update dist
• 360237f Strict equality
• 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
• f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
• 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
• Additional commits viewable in compare view

Updates davelosert/vitest-coverage-report-action from 2.12.1 to 2.12.2

Release notes

Sourced from davelosert/vitest-coverage-report-action's releases.

v2.12.2

2.12.2 (2026-07-14)

Bug Fixes

• color status icon by vitest threshold pass/fail when threshold-icons is unset (#648) (2500e23), closes #557 #580
• deps-dev: bump @​biomejs/biome from 2.5.0 to 2.5.1 (#642) (3712652)
• deps-dev: bump @​types/node in the build-deps group (#640) (6304193)
• deps-dev: bump the build-deps group with 2 updates (#641) (a9fb062)

Commits

• 8b15768 chore(release): 2.12.2 [skip ci]
• 2500e23 fix: color status icon by vitest threshold pass/fail when threshold-icons is ...
• ce36815 Handle 0 coverage thresholds in summary target display (#649)
• 2d3579c chore(deps-dev): bump semantic-release (#651)
• 21e726f chore(deps-dev): bump the build-deps group with 3 updates (#650)
• f6ff263 chore(deps-dev): bump the build-deps group with 4 updates (#643)
• 69fe23d chore(deps-dev): bump @​semantic-release/github (#644)
• 53d2386 chore(deps-dev): bump @​biomejs/biome from 2.5.1 to 2.5.2 (#645)
• a9fb062 fix(deps-dev): bump the build-deps group with 2 updates (#641)
• 3712652 fix(deps-dev): bump @​biomejs/biome from 2.5.0 to 2.5.1 (#642)
• Additional commits viewable in compare view

Updates github/gh-aw from 0.81.6 to 0.82.13

Release notes

Sourced from github/gh-aw's releases.

v0.82.13

🌟 Release Highlights

This release brings smarter ESLint rule detection, improved audit accuracy, and key bug fixes across the CLI, workshop, and setup tooling — with a notable breaking change in gh aw add.

⚠️ Breaking Changes

• gh aw add now rejects packages with aw.yml config — packages that include an aw.yml configuration file will no longer be accepted. Update any such packages before upgrading. See [PR #46273](github/gh-aw#46273) for details.

✨ What's New

• Auto-configure COPILOT_PROVIDER_WIRE_API from the model catalog (#46156) — The CLI now automatically resolves the provider wire API endpoint from the model catalog, reducing manual configuration overhead.
• Default-on issue intent metadata (#46207) — set_issue_type, set_issue_field, and add_labels now emit issue intent metadata by default, enabling richer audit trails without extra configuration.
• NO_COLOR support for stdout (#46197) — The CLI now honours the NO_COLOR environment variable, improving compatibility with non-interactive and accessibility-focused terminals.
• Stronger ESLint alias detection (#46365) — The no-core-setoutput/exportvariable rules now catch aliased and destructured @actions/core bindings, closing a common bypass pattern.
• Debug logging across CLI bootstrap and logs orchestration (#46337) — New structured debug output makes it easier to trace startup and log-download behaviour.

🐛 Bug Fixes & Improvements

• Accurate safe-output write counts in audit reports (#46360) — SafeItemsCount is now correctly populated in run_summary.json, so audit dashboards reflect real write activity.
• Workshop progress rail and overflow fixes (#46378) — Resolves state coupling in the progress rail and responsive overflow issues in the workshop UI.
• ESLint spawn-error alias guard (#46199) — Single-assignment aliases of spawn errors are now correctly recognised as valid guards, reducing false positives.
• mapdeletecheck autofix safety (#46159) — Autofixes are now suppressed when comments overlap the replaced span, preventing incorrect edits.
• Setup-JS error resilience (#46102) — All synchronous filesystem calls in actions/setup/js are now wrapped in try/catch blocks.
• Integer overflow fix in allocation size hints (#46375) — Resolves a go/allocation-size-overflow code scanning alert.

📚 Documentation

• Workshop view guide added (#46237) — New documentation covering the workshop UI view.
• Ephemerals reference streamlined (#46288) — The ephemerals reference page has been trimmed for clarity and readability.
• ESLint factory rules documented (#46361) — Six previously undocumented ESLint factory rules now have full README entries.

[!WARNING]

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

... (truncated)

Commits

• 017cdbc fix: populate SafeItemsCount in run_summary.json so audits report accurate sa...
• f6feabb [code-scanning-fix] Fix go/allocation-size-overflow: integer overflow in allo...
• 9ecb2eb feat(styles,console,colorwriter): hoist palette color.Color vars and honor NO...
• 991f7d4 Default-on issue intent metadata for set_issue_type, set_issue_field, and add...
• e9f95f2 feat(eslint): extend no-core-setoutput/exportvariable rules to detect aliased...
• 65a55ec test(errorutil): improve edge-case coverage and reduce assertion noise (#46366)
• 54e9fe9 [jsweep] Clean validate_secrets.cjs (#46129)
• 61e0494 docs(eslint-factory): document 6 undocumented rules in README (#46361)
• 75936ce [formal-spec] Add PM-10/AppG formal model coverage for security architecture ...
• 72b1988 fix(eslint): resolve route/URL/control-flow lint violations in actions/setup/...
• Additional commits viewable in compare view

Updates github/gh-aw/actions/setup from 0.81.6 to 0.82.13

Release notes

Sourced from github/gh-aw/actions/setup's releases.

v0.82.13

🌟 Release Highlights

This release brings smarter ESLint rule detection, improved audit accuracy, and key bug fixes across the CLI, workshop, and setup tooling — with a notable breaking change in gh aw add.

⚠️ Breaking Changes

• gh aw add now rejects packages with aw.yml config — packages that include an aw.yml configuration file will no longer be accepted. Update any such packages before upgrading. See [PR #46273](github/gh-aw#46273) for details.

✨ What's New

• Auto-configure COPILOT_PROVIDER_WIRE_API from the model catalog (#46156) — The CLI now automatically resolves the provider wire API endpoint from the model catalog, reducing manual configuration overhead.
• Default-on issue intent metadata (#46207) — set_issue_type, set_issue_field, and add_labels now emit issue intent metadata by default, enabling richer audit trails without extra configuration.
• NO_COLOR support for stdout (#46197) — The CLI now honours the NO_COLOR environment variable, improving compatibility with non-interactive and accessibility-focused terminals.
• Stronger ESLint alias detection (#46365) — The no-core-setoutput/exportvariable rules now catch aliased and destructured @actions/core bindings, closing a common bypass pattern.
• Debug logging across CLI bootstrap and logs orchestration (#46337) — New structured debug output makes it easier to trace startup and log-download behaviour.

🐛 Bug Fixes & Improvements

• Accurate safe-output write counts in audit reports (#46360) — SafeItemsCount is now correctly populated in run_summary.json, so audit dashboards reflect real write activity.
• Workshop progress rail and overflow fixes (#46378) — Resolves state coupling in the progress rail and responsive overflow issues in the workshop UI.
• ESLint spawn-error alias guard (#46199) — Single-assignment aliases of spawn errors are now correctly recognised as valid guards, reducing false positives.
• mapdeletecheck autofix safety (#46159) — Autofixes are now suppressed when comments overlap the replaced span, preventing incorrect edits.
• Setup-JS error resilience (#46102) — All synchronous filesystem calls in actions/setup/js are now wrapped in try/catch blocks.
• Integer overflow fix in allocation size hints (#46375) — Resolves a go/allocation-size-overflow code scanning alert.

📚 Documentation

• Workshop view guide added (#46237) — New documentation covering the workshop UI view.
• Ephemerals reference streamlined (#46288) — The ephemerals reference page has been trimmed for clarity and readability.
• ESLint factory rules documented (#46361) — Six previously undocumented ESLint factory rules now have full README entries.

[!WARNING]

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

... (truncated)

Commits

• 017cdbc fix: populate SafeItemsCount in run_summary.json so audits report accurate sa...
• f6feabb [code-scanning-fix] Fix go/allocation-size-overflow: integer overflow in allo...
• 9ecb2eb feat(styles,console,colorwriter): hoist palette color.Color vars and honor NO...
• 991f7d4 Default-on issue intent metadata for set_issue_type, set_issue_field, and add...
• e9f95f2 feat(eslint): extend no-core-setoutput/exportvariable rules to detect aliased...
• 65a55ec test(errorutil): improve edge-case coverage and reduce assertion noise (#46366)
• 54e9fe9 [jsweep] Clean validate_secrets.cjs (#46129)
• 61e0494 docs(eslint-factory): document 6 undocumented rules in README (#46361)
• 75936ce [formal-spec] Add PM-10/AppG formal model coverage for security architecture ...
• 72b1988 fix(eslint): resolve route/URL/control-flow lint violations in actions/setup/...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

✅ Test & Coverage Summary

Tier	Tests	Passed	Failed	Skipped	Time	Stmts	Branch	Funcs	Lines
✅ Unit Tests	2119	2119	0	0	20.9s	78.4% ✅	70.2% ✅	81.0% ✅	78.9% ✅
✅ Integration L3	256	256	0	0	12.2s	33.3% ✅	30.7% ✅	32.1% ✅	33.8% ✅
✅ Integration L4-L6	80	80	0	0	1.7s	19.2% ✅	15.3% ✅	21.9% ✅	19.7% ✅
✅ Integration L7	244	244	0	0	2.5s	66.0% ✅	53.8% ✅	72.0% ✅	67.1% ✅
✅ E2E	236	236	0	0	16.3s	10.8% ✅	7.5% ❌	10.4% ❌	11.1% ✅
Total	2935	2935	0	0

📊 Unit Coverage Details (78.9% lines)

Metric	Covered / Total	Percentage
Statements	6280/8006	78.44%
Branches	3055/4352	70.19%
Functions	1246/1539	80.96%
Lines	5959/7556	78.86%

[github-actions]

Coverage Report for Unit

Status	Category	Percentage	Covered / Total
🟢	Lines	78.86% (🎯 0%)	5959 / 7556
🟢	Statements	78.44% (🎯 0%)	6280 / 8006
🟢	Functions	80.96% (🎯 0%)	1246 / 1539
🟢	Branches	70.19% (🎯 0%)	3055 / 4352

File Coverage

No changed files found.

Generated in workflow #502 for commit c87513a by the Vitest Coverage Report Action