Merge branch 'main' into xuan.hu/copier-manager

Author: huxuan

.devcontainer/Dockerfile

@@ -27,7 +27,7 @@ ARG BASH_COMPLETION_VERSION="1:2.11-6"
 # renovate: depName=debian_12/pipx
 ARG PIPX_VERSION="1.1.0-1"
 # renovate: depName=debian_12/sudo
-ARG SUDO_VERSION="1.9.13p3-1+deb12u1"
+ARG SUDO_VERSION="1.9.13p3-1+deb12u2"
 # renovate: depName=debian_12/vim
 ARG VIM_VERSION="2:9.0.1378-2+deb12u2"
 

.github/workflows/ci.yml

@@ -23,11 +23,11 @@ jobs:
         with:
           fetch-depth: 0
       - name: Set up PDM
-        uses: pdm-project/setup-pdm@deb8d8a4e2a03aabcef6f2cc981923fc6b29ef99 # v4.3
+        uses: pdm-project/setup-pdm@94a823180e06fcde4ad29308721954a521c96ed0 # v4.4
         with:
           cache: true
           python-version: ${{ matrix.python-version }}
-          version: 2.24.1
+          version: 2.25.4
           cache-dependency-path: |
             ./pdm.dev.lock
             ./pdm.lock

.github/workflows/commitlint.yml

@@ -21,7 +21,7 @@ concurrency:
 jobs:
   commitlint:
     container:
-      image: commitlint/commitlint:19.8.0@sha256:958687656a296dd0b62c8d97c5856fdbc7c312ce06046a7c5980eaee4e7e69d6
+      image: commitlint/commitlint:19.8.1@sha256:bbfb5e986b5da3962a114270f28e854413e5b89317dbbecb36ecaabbb46082bc
     runs-on: ubuntu-24.04
     steps:
       - run: env | sort

.github/workflows/release.yml

@@ -21,11 +21,11 @@ jobs:
         with:
           fetch-depth: 0
       - name: Set up PDM
-        uses: pdm-project/setup-pdm@deb8d8a4e2a03aabcef6f2cc981923fc6b29ef99 # v4.3
+        uses: pdm-project/setup-pdm@94a823180e06fcde4ad29308721954a521c96ed0 # v4.4
         with:
           cache: true
           python-version: "3.12"
-          version: 2.24.1
+          version: 2.25.4
           cache-dependency-path: |
             ./pdm.dev.lock
             ./pdm.lock
@@ -128,11 +128,11 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Set up PDM
-        uses: pdm-project/setup-pdm@deb8d8a4e2a03aabcef6f2cc981923fc6b29ef99 # v4.3
+        uses: pdm-project/setup-pdm@94a823180e06fcde4ad29308721954a521c96ed0 # v4.4
         with:
           cache: true
           python-version: "3.12"
-          version: 2.24.1
+          version: 2.25.4
           cache-dependency-path: |
             ./pdm.dev.lock
             ./pdm.lock

.github/workflows/renovate.yml

@@ -24,15 +24,15 @@ jobs:
         RENOVATE_PLATFORM: github
         RENOVATE_REPOSITORIES: '["${{ github.repository }}"]'
         RENOVATE_REPOSITORY_CACHE: enabled
-      image: ghcr.io/renovatebot/renovate:40.57.0@sha256:bba7917123bf0f3b6d7c7347e0c9ea6480e6298bab986aef7740a56dcf8166cf
+      image: ghcr.io/renovatebot/renovate:41.32.0@sha256:51416fe84e2199ef20b6012d5fda8a3fe9e4e181b49610d81733ee04f0c8454f
       options: "--user root"
     runs-on: ubuntu-24.04
     steps:
       - run: env | sort
       - id: generate-token
         name: Generate a token with GitHub App if App ID exists
         if: vars.BOT_APP_ID
-        uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
         with:
           app-id: ${{ vars.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}

.github/workflows/semantic-release.yml

@@ -21,7 +21,7 @@ jobs:
       - id: generate-token
         name: Generate a token with GitHub App if App ID exists
         if: vars.BOT_APP_ID
-        uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
         with:
           app-id: ${{ vars.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
@@ -45,6 +45,6 @@ jobs:
           GITHUB_TOKEN: ${{ steps.generate-token.outputs.token || secrets.PAT || secrets.GITHUB_TOKEN }}
         run: >
           npx
-          --package conventional-changelog-conventionalcommits@8.0.0
-          --package [email protected].3
+          --package conventional-changelog-conventionalcommits@9.1.0
+          --package [email protected].7
           semantic-release

.gitlab/workflows/commitlint.yml

@@ -1,6 +1,6 @@
 commitlint:
   image:
-    name: commitlint/commitlint:19.8.0@sha256:958687656a296dd0b62c8d97c5856fdbc7c312ce06046a7c5980eaee4e7e69d6
+    name: commitlint/commitlint:19.8.1@sha256:bbfb5e986b5da3962a114270f28e854413e5b89317dbbecb36ecaabbb46082bc
     entrypoint: ['']
   interruptible: true
   rules:

.gitlab/workflows/devcontainer.yml

@@ -1,5 +1,5 @@
 dev-container-publish:
-  image: docker:28.1.1@sha256:f49e1c71b5d9f8ebe53715f78996ce42b8be4b1ec03875d187dfe3c03de1dc00
+  image: docker:28.3.2@sha256:684bc226a69eb91582738f196e59e234355420ee592abea7685e4127afbce645
   parallel:
     matrix:
       - PYTHON_VERSION:
@@ -60,7 +60,7 @@ dev-container-publish:
           --target dev
       fi
   services:
-    - docker:28.1.1@sha256:f49e1c71b5d9f8ebe53715f78996ce42b8be4b1ec03875d187dfe3c03de1dc00
+    - docker:28.3.2@sha256:684bc226a69eb91582738f196e59e234355420ee592abea7685e4127afbce645
   stage: build
   variables:
     DOCKER_TLS_CERTDIR: /certs

.gitlab/workflows/release.yml

@@ -31,7 +31,7 @@ pages:
   variables:
     GIT_STRATEGY: none
 container-publish:
-  image: docker:28.1.1@sha256:f49e1c71b5d9f8ebe53715f78996ce42b8be4b1ec03875d187dfe3c03de1dc00
+  image: docker:28.3.2@sha256:684bc226a69eb91582738f196e59e234355420ee592abea7685e4127afbce645
   parallel:
     matrix:
       - PYTHON_VERSION:
@@ -91,7 +91,7 @@ container-publish:
         --tag ${CI_REGISTRY_IMAGE}:py${PYTHON_VERSION}-${CI_COMMIT_TAG} \
         --target prod
   services:
-    - docker:28.1.1@sha256:f49e1c71b5d9f8ebe53715f78996ce42b8be4b1ec03875d187dfe3c03de1dc00
+    - docker:28.3.2@sha256:684bc226a69eb91582738f196e59e234355420ee592abea7685e4127afbce645
   stage: release
   variables:
     DOCKER_TLS_CERTDIR: /certs

.gitlab/workflows/renovate.yml

@@ -3,7 +3,7 @@ renovate:
     key: ${CI_COMMIT_REF_SLUG}-renovate
     paths:
       - renovate/cache/renovate/repository/
-  image: renovate/renovate:40.57.0@sha256:bba7917123bf0f3b6d7c7347e0c9ea6480e6298bab986aef7740a56dcf8166cf
+  image: renovate/renovate:41.32.0@sha256:51416fe84e2199ef20b6012d5fda8a3fe9e4e181b49610d81733ee04f0c8454f
   rules:
     - if: $CI_PIPELINE_SOURCE == "schedule" && $PAT != null
   script: renovate $RENOVATE_EXTRA_FLAG