Bump the github_actions group with 5 updates

[dependabot]

Bumps the github_actions group with 5 updates:

Package	From	To
actions/checkout	4	5
crate-ci/typos	1.35.1	1.38.1
google/osv-scanner-action	2.2.1	2.2.3
cargo-bins/cargo-binstall	1.14.4	1.15.7
actions/download-artifact	4	5

Updates actions/checkout from 4 to 5

Release notes

Sourced from actions/checkout's releases.

v5.0.0

What's Changed

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226
• Prepare v5.0.0 release by @​salmanmkc in actions/checkout#2238

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.0

What's Changed

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236
• Prepare release v4.3.0 by @​salmanmkc in actions/checkout#2237

New Contributors

• @​motss made their first contribution in actions/checkout#1971
• @​mouismail made their first contribution in actions/checkout#1977
• @​benwells made their first contribution in actions/checkout#2043
• @​nebuk89 made their first contribution in actions/checkout#2194
• @​salmanmkc made their first contribution in actions/checkout#2236

Full Changelog: actions/checkout@v4...v4.3.0

v4.2.2

What's Changed

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

Full Changelog: actions/checkout@v4.2.1...v4.2.2

v4.2.1

What's Changed

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

New Contributors

• @​Jcambass made their first contribution in actions/checkout#1919

Full Changelog: actions/checkout@v4.2.0...v4.2.1

... (truncated)

Commits

• 08c6903 Prepare v5.0.0 release (#2238)
• 9f26565 Update actions checkout to use node 24 (#2226)
• See full diff in compare view

Updates crate-ci/typos from 1.35.1 to 1.38.1

Release notes

Sourced from crate-ci/typos's releases.

v1.38.1

[1.38.1] - 2025-10-07

Fixes

• Ignore common golang identifiers

v1.38.0

[1.38.0] - 2025-10-06

Features

• Update type list

Fixes

• Don't correct typ
• Consistently error on unused config fields

v1.37.3

[1.37.3] - 2025-10-06

Fixes

• Don't correct PN for bitbake file types

v1.37.2

[1.37.2] - 2025-10-03

Fixes

• Don't suggest diagnostic for diagnotics, preferring diagnostics

v1.37.1

[1.37.1] - 2025-10-01

Fixes

• Don't offer corrections to ""

v1.37.0

[1.37.0] - 2025-09-30

Features

• Updated the dictionary with the September 2025 changes
• Pull in other dictionary updates

v1.36.3

[1.36.3] - 2025-09-25

... (truncated)

Changelog

Sourced from crate-ci/typos's changelog.

[1.38.1] - 2025-10-07

Fixes

• Ignore common golang identifiers

[1.38.0] - 2025-10-06

Features

• Update type list

Fixes

• Don't correct typ
• Consistently error on unused config fields

[1.37.3] - 2025-10-06

Fixes

• Don't correct PN for bitbake file types

[1.37.2] - 2025-10-03

Fixes

• Don't suggest diagnostic for diagnotics, preferring diagnostics

[1.37.1] - 2025-10-01

Fixes

• Don't offer corrections to ""

[1.37.0] - 2025-09-30

Features

• Updated the dictionary with the September 2025 changes
• Pull in other dictionary updates

[1.36.3] - 2025-09-25

Fixes

• Fix typo in correction to analysises

[1.36.2] - 2025-09-04

... (truncated)

Commits

• 80c8a49 chore: Release
• c1008ce docs: Update changelog
• 62a3b50 Merge pull request #1398 from ccoveille-forks/go-exclusions
• e6bedbd fix(config): Add some Go exclusions
• 90cacd6 docs(ref): Speak to glob ambiguity
• b81b12e docs(ref): Clarify directories are not spell checked
• eaf25df docs(ref): Speak to locale's behavior
• a9735e2 docs(ref): Provide identifier/word config examples
• 3c14191 docs(ref): Talk about include lists
• d0f81dc docs(ref): Re-organize help more like cargo
• Additional commits viewable in compare view

Updates google/osv-scanner-action from 2.2.1 to 2.2.3

Release notes

Sourced from google/osv-scanner-action's releases.

v2.2.3

What's Changed

• chore(deps): update workflows by @​renovate-bot in google/osv-scanner-action#86
• chore(deps): update workflows to v5 (major) by @​renovate-bot in google/osv-scanner-action#87
• Update to v2.2.3 by @​jess-lowe in google/osv-scanner-action#101

Full Changelog: google/osv-scanner-action@v2.2.2...v2.2.3

v2.2.2

This updates OSV-Scanner to v2.2.2.

What's Changed

• docs: Update Automatic install instructions by @​another-rex in google/osv-scanner-action#94
• Update to v2.2.2 by @​cuixq in google/osv-scanner-action#95

Full Changelog: google/osv-scanner-action@v2.2.1...v2.2.2

Commits

• e92b5d0 Merge pull request #101 from google/update-to-v2.2.3
• c1fee26 Update unified workflow example to point to v2.2.3 reusable workflows
• e161549 Update reusable workflows to point to v2.2.3 actions
• b930bc9 "Update actions to use v2.2.3 osv-scanner image"
• c0e8a11 Merge pull request #87 from renovate-bot/renovate/major-workflows
• f317cb8 chore(deps): update workflows to v5
• 9e22416 Merge pull request #86 from renovate-bot/renovate/workflows
• 90b209d Merge pull request #95 from google/update-to-v2.2.2
• 4971fe8 Update unified workflow example to point to v2.2.2 reusable workflows
• 9d4732e Update reusable workflows to point to v2.2.2 actions
• Additional commits viewable in compare view

Updates cargo-bins/cargo-binstall from 1.14.4 to 1.15.7

Release notes

Sourced from cargo-bins/cargo-binstall's releases.

v1.15.7

Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for cargo install in most cases. Install it today with cargo install cargo-binstall, from the binaries below, or if you already have it, upgrade with cargo binstall cargo-binstall.

In this release:

• Updated example of CLI argument in README (#2326)

Other changes:

• Upgrade dependencies

v1.15.6

Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for cargo install in most cases. Install it today with cargo install cargo-binstall, from the binaries below, or if you already have it, upgrade with cargo binstall cargo-binstall.

In this release:

• Upgrade dependencies

v1.15.5

Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for cargo install in most cases. Install it today with cargo install cargo-binstall, from the binaries below, or if you already have it, upgrade with cargo binstall cargo-binstall.

In this release:

• support socks5 https_proxy (#2303 #2306)
• docs: improve registry command line option documentation (#2302)
• docs: add HELP.md which contains doc for all command line options (#2297)

Other changes:

• Upgrade dependencies

v1.15.4

Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for cargo install in most cases. Install it today with cargo install cargo-binstall, from the binaries below, or if you already have it, upgrade with cargo binstall cargo-binstall.

In this release:

• clarify --install-path behavior when installing from source (#2259 #2294)

Other changes:

• bump dependencies (#2295 #2298 #2299)

v1.15.3

Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for cargo install in most cases. Install it today with cargo install cargo-binstall, from the binaries below, or if you already have it, upgrade with cargo binstall cargo-binstall.

In this release:

• Upgrade (de)compression libraries (#2289)
• Fix release pipeline: stop building for x86_64h-apple-darwin since it is broken and is a rarely used tier 3 target, plus GHA no longer offers x86_64 mac (#2292)

... (truncated)

Commits

• a66119f release: cargo-binstall v1.15.7 (#2331)
• 78d315a chore: release (#2325)
• bd81950 dep: Upgrade transitive dependencies (#2329)
• aee29ea build(deps): bump clap-cargo from 0.17.1 to 0.18.0 in the deps group (#2327)
• fea12d0 Fix outdated cli argument examples (#2326)
• 3e28615 dep: Upgrade transitive dependencies (#2324)
• 38e8f5e release: cargo-binstall v1.15.6 (#2323)
• 2da41f3 chore: release (#2322)
• 96c132b dep: Upgrade transitive dependencies (#2321)
• abba1f1 ci: Fix action.yml (#2319)
• Additional commits viewable in compare view

Updates actions/download-artifact from 4 to 5

Release notes

Sourced from actions/download-artifact's releases.

v5.0.0

What's Changed

• Update README.md by @​nebuk89 in actions/download-artifact#407
• BREAKING fix: inconsistent path behavior for single artifact downloads by ID by @​GrantBirki in actions/download-artifact#416

v5.0.0

🚨 Breaking Change

This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.

What Changed

Previously, single artifact downloads behaved differently depending on how you specified the artifact:

• By name: name: my-artifact → extracted to path/ (direct)
• By ID: artifact-ids: 12345 → extracted to path/my-artifact/ (nested)

Now both methods are consistent:

• By name: name: my-artifact → extracted to path/ (unchanged)
• By ID: artifact-ids: 12345 → extracted to path/ (fixed - now direct)

Migration Guide

✅ No Action Needed If:

• You download artifacts by name
• You download multiple artifacts by ID
• You already use merge-multiple: true as a workaround

⚠️ Action Required If:

You download single artifacts by ID and your workflows expect the nested directory structure.

Before v5 (nested structure):

- uses: actions/download-artifact@v4
  with:
    artifact-ids: 12345
    path: dist
# Files were in: dist/my-artifact/

Where my-artifact is the name of the artifact you previously uploaded

To maintain old behavior (if needed):

</tr></table> 

... (truncated)

Commits

• 634f93c Merge pull request #416 from actions/single-artifact-id-download-path
• b19ff43 refactor: resolve download path correctly in artifact download tests (mainly ...
• e262cbe bundle dist
• bff23f9 update docs
• fff8c14 fix download path logic when downloading a single artifact by id
• 448e3f8 Merge pull request #407 from actions/nebuk89-patch-1
• 47225c4 Update README.md
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.