build(deps): bump the github-actions group with 2 updates

[dependabot]

Bumps the github-actions group with 2 updates: metcalfc/changelog-generator and softprops/action-gh-release.

Updates metcalfc/changelog-generator from 4.8.0 to 5.0.1

Release notes

Sourced from metcalfc/changelog-generator's releases.

Release v5.0.1

• 031a640 - 5.0.1
• 122a6c2 - Base the changelog on the previous release of the same line, and assert it ([#479](https://github.com/metcalfc/changelog-generator/issues/479))
• 0bee5ad - fix: return the modified changelog as a real multiline output ([#478](https://github.com/metcalfc/changelog-generator/issues/478))

Release v5.0.0

Breaking change: commit subjects render as literal text

Every changelog line now wraps the commit subject in an inline-code span.

before:  - [f723555](https://github.com/metcalfc/changelog-generator/blob/HEAD/.../commit/f723555) - build(deps-dev): bump @vercel/ncc to 0.45.0 ([#470](https://github.com/metcalfc/changelog-generator/issues/470))
after:   - [f723555](https://github.com/metcalfc/changelog-generator/blob/HEAD/.../commit/f723555) - ` build(deps-dev): bump @vercel/ncc to 0.45.0 ([#470](https://github.com/metcalfc/changelog-generator/issues/470)) `

A commit subject is untrusted input. Anyone whose pull request you merge chooses that text, and this action pastes it directly into your release notes. Rendered as active Markdown, a subject could contribute links, images, @mentions, issue references, raw HTML, or additional changelog entries to a release it had no business editing. Rendering it as literal text closes that off.

What this costs you. Subjects render monospace, and [#123](https://github.com/metcalfc/changelog-generator/issues/123), [GH-123](https://github.com/metcalfc/changelog-generator/issues/123), bare commit SHAs, and :emoji: inside a subject no longer autolink. Because GitHub's squash merge appends ([#123](https://github.com/metcalfc/changelog-generator/issues/123)) to the subject by default, most lines in a typical repository lose that link. The generated commit link at the start of each line is unaffected. Control characters, line and paragraph separators, and bidirectional-control characters are replaced with spaces, so a subject can never span more than its own line.

No inputs or outputs changed, and the No Changes. sentinel is unchanged.

Staying on the previous format

v4.9.0 carries every security and dependency fix in this release -- including undici 7.29.0, which closes 12 advisories -- with the v4 output format untouched. Pin metcalfc/changelog-generator@v4 to stay there. The v4 tag will keep moving on the maintenance line.

What is in this release

Relative to v4.9.0, v5.0.0 adds only the escaping change. Both releases share everything else:

• Render changelog subjects as literal text (#475) -- v5 only
• Keep release tag names out of shell source (#473)
• Verify release bundle before attestation (#474)
• Bound the dependency overrides and clear the undici advisories (#476)
• Stop bump:workflow rewriting pinned actions' provenance comments (#477)

... (truncated)

Commits

• 031a640 5.0.1
• 122a6c2 Base the changelog on the previous release of the same line, and assert it (#...
• 0bee5ad fix: return the modified changelog as a real multiline output (#478)
• c040ad6 5.0.0
• 6a23679 fix: stop bump:workflow rewriting pinned actions' provenance comments (#477)
• 8becfce fix(deps): bound the dependency overrides and clear the undici advisories (#476)
• f723555 build(deps-dev): bump @​vercel/ncc from 0.44.1 to 0.45.0 (#470)
• 88097f8 build(deps-dev): bump eslint from 10.8.1 to 10.9.0 (#472)
• 430ccb9 build(deps-dev): bump globals from 17.9.0 to 17.11.0 (#471)
• d40422b build(deps): bump the codeql-action group with 3 updates (#469)
• Additional commits viewable in compare view

Updates softprops/action-gh-release from 3.0.2 to 3.0.3

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.3

3.0.3 is a maintenance release with updated dependencies. It also safely classifies malformed GitHub API errors to avoid secondary failures (#822).

What's Changed

Bug fixes 🐛

• fix: safely classify GitHub API errors by @​chenrui333 in softprops/action-gh-release#822

Other Changes 🔄

• dependency updates

Changelog

Sourced from softprops/action-gh-release's changelog.

3.0.3

3.0.3 is a maintenance release with updated dependencies. It also safely classifies malformed GitHub API errors to avoid secondary failures (#822).

What's Changed

Bug fixes 🐛

• fix: safely classify GitHub API errors by @​chenrui333 in softprops/action-gh-release#822

Other Changes 🔄

• dependency updates

3.0.2

3.0.2 is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since 3.0.1.

This release fixes #795, #438, and #803. The upload transport hardening covers the historical failure reported in #790, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to #786 and does not claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

• feat: improve release error reporting and test coverage by @​chenrui333 in softprops/action-gh-release#813

Bug fixes 🐛

• fix: publish existing draft releases as prereleases by @​godfengliang in softprops/action-gh-release#801
• fix: upload small checksum assets reliably by @​chenrui333 in softprops/action-gh-release#815
• fix: replace existing release assets on Gitea by @​chenrui333 in softprops/action-gh-release#816
• fix: clarify release creation 404 errors by @​chenrui333 in softprops/action-gh-release#817

Other Changes 🔄

• chore(deps): upgrade TypeScript to 7 by @​chenrui333 in softprops/action-gh-release#812
• chore(deps): remove unused TypeScript tooling by @​chenrui333 in softprops/action-gh-release#814
• dependency, Node 24 pin, and CI maintenance merged since 3.0.1

3.0.1

• maintenance release with updated dependencies

... (truncated)

Commits

• efb3536 release 3.0.3 (#840)
• 6441963 chore(deps): bump the npm group with 2 updates (#839)
• e5ee6bc chore(deps): bump esbuild from 0.28.1 to 0.28.2 in the npm group (#837)
• d1e6617 chore(deps): bump undici from 6.27.0 to 6.28.0 (#831)
• 6403751 chore(deps): bump the npm group with 2 updates (#835)
• 7c7184b chore(deps): bump postcss from 8.5.19 to 8.5.25 (#833)
• 0f3f0d2 chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 (#832)
• 77fb938 chore(deps): bump prettier from 3.9.5 to 3.9.6 in the npm group (#830)
• 5a6f517 chore(deps): bump brace-expansion from 5.0.7 to 5.0.8 (#828)
• a3c91c9 chore(deps): bump the github-actions group with 2 updates (#825)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions