chore(deps): update github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/cache	action	patch	v5.0.3 → v5.0.4
actions/download-artifact	action	patch	v8.0.0 → v8.0.1
actions/download-artifact	action	patch	8.0.0 → 8.0.1
actions/setup-go	action	minor	v6.2.0 → v6.3.0
benchmark-action/github-action-benchmark	action	minor	v1.20.7 → v1.21.0
codecov/codecov-action	action	patch	v5.5.2 → v5.5.3
golangci/golangci-lint	uses-with	minor	v2.10.0 → v2.11.4
release-drafter/release-drafter	action	minor	v6.2.0 → v6.4.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/cache (actions/cache)

v5.0.4

Compare Source

actions/download-artifact (actions/download-artifact)

v8.0.1

Compare Source

What's Changed

• Support for CJK characters in the artifact name by @​danwkennedy in #​471
• Add a regression test for artifact name + content-type mismatches by @​danwkennedy in #​472

Full Changelog: actions/download-artifact@v8...v8.0.1

actions/setup-go (actions/setup-go)

v6.3.0

Compare Source

What's Changed

• Update default Go module caching to use go.mod by @​priyagupta108 in #​705
• Fix golang download url to go.dev by @​178inaba in #​469

Full Changelog: actions/setup-go@v6...v6.3.0

benchmark-action/github-action-benchmark (benchmark-action/github-action-benchmark)

v1.21.0

Compare Source

• fix include package name for duplicate bench names (#​330)
• fix avoid duplicate package suffix in Go benchmarks (#​337)

codecov/codecov-action (codecov/codecov-action)

v5.5.3

Compare Source

What's Changed

• build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @​dependabot[bot] in #​1874
• chore(release): bump to 5.5.3 by @​thomasrockhu-codecov in #​1922

Full Changelog: codecov/codecov-action@v5.5.2...v5.5.3

golangci/golangci-lint (golangci/golangci-lint)

v2.11.4

Compare Source

Released on 2026-03-22

1. Linters bug fixes
   • govet-modernize: from 0.42.0 to 0.43.0
   • noctx: from 0.5.0 to 0.5.1
   • sqlclosecheck: from 0.5.1 to 0.6.0

v2.11.3

Compare Source

Released on 2026-03-10

1. Linters bug fixes
   • gosec: from v2.24.7 to 619ce21

v2.11.2

Compare Source

Released on 2026-03-07

1. Fixes
   • fmt: fix error when using the fmt command with explicit paths.

v2.11.1

Compare Source

Released on 2026-03-06

Due to an error related to AUR, some artifacts of the v2.11.0 release have not been published.

This release contains the same things as v2.11.0.

v2.11.0

Compare Source

Released on 2026-03-06

1. Linters new features or changes
   • errcheck: from 1.9.0 to 1.10.0 (exclude crypto/rand.Read by default)
   • gosec: from 2.23.0 to 2.24.6 (new rules: G113, G118, G119, G120, G121, G122, G123, G408, G707)
   • noctx: from 0.4.0 to 0.5.0 (new detection: httptest.NewRequestWithContext)
   • prealloc: from 1.0.2 to 1.1.0
   • revive: from 1.14.0 to 1.15.0 (⚠️ Breaking change: package-related checks moved from var-naming to a new rule package-naming)
2. Linters bug fixes
   • gocognit: from 1.2.0 to 1.2.1
   • gosec: from 2.24.6 to 2.24.7
   • unqueryvet: from 1.5.3 to 1.5.4

v2.10.1

Compare Source

Released on 2026-02-17

1. Fixes
   • buildssa panic

release-drafter/release-drafter (release-drafter/release-drafter)

v6.4.0

Compare Source

What's Changed

New

• feat: Add support to excluded-paths (#​1522) @​guimorg
• feat: add include-pre-releases to action inputs (#​1525) @​cchanche

Maintenance

• revert: deprecate include-pre-releases (#​1523) @​cchanche

Full Changelog: release-drafter/release-drafter@v6.3.0...v6.4.0

v6.3.0

Compare Source

What's Changed

New

• feat: deprecate include-pre-releases in favor of prerelease (#​1515) @​christopherklint97

Maintenance

• chore: use probot logger instead of @​actions/core (#​1520) @​cchanche

Dependency Updates

8 changes

• chore: update lockfile (#​1521) @​cchanche
• build(deps-dev): bump brace-expansion from 1.1.11 to 1.1.12 (#​1494) @​dependabot[bot]
• build(deps): bump js-yaml (#​1493) @​dependabot[bot]
• build(deps-dev): bump node-fetch from 2.6.7 to 2.7.0 (#​1485) @​dependabot[bot]
• build(deps-dev): bump @​vercel/ncc from 0.34.0 to 0.38.4 (#​1484) @​dependabot[bot]
• build(deps): bump deepmerge from 4.2.2 to 4.3.1 (#​1482) @​dependabot[bot]
• build(deps): bump jws from 3.2.2 to 3.2.3 (#​1495) @​dependabot[bot]
• build(deps): bump lodash from 4.17.21 to 4.17.23 (#​1489) @​dependabot[bot]

Full Changelog: release-drafter/release-drafter@v6.2.0...v6.3.0

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.02%. Comparing base (4a95e53) to head (05a3e8d).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1564   +/-   ##
=======================================
  Coverage   85.02%   85.02%           
=======================================
  Files         103      103           
  Lines       13589    13589           
=======================================
  Hits        11554    11554           
  Misses       1518     1518           
  Partials      517      517           

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4a95e53...05a3e8d. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.