Update maintenance

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
actions/dependency-review-action	action	patch	v4.3.3 -> v4.3.4
actions/setup-python	action	patch	v5.1.0 -> v5.1.1
pylint (changelog)		patch	==3.2.5 -> ==3.2.6
step-security/harden-runner	action	minor	v2.8.1 -> v2.9.0
tox (changelog)		minor	==4.15.1 -> ==4.16.0

---

Release Notes

actions/dependency-review-action (actions/dependency-review-action)

v4.3.4

Compare Source

What's Changed

• Include all added dependencies in scorecard entries by @​elireisman in https://github.com/actions/dependency-review-action/pull/783
• Update SPDX Expression Parsing by @​febuiles in https://github.com/actions/dependency-review-action/pull/719
  • This PR is a significant refactor of SPDX expression parsing that may fix some bugs, but unfortunately there are several related known issues that remain unresolved as of this version.

Full Changelog: actions/dependency-review-action@v4.3.3...v4.3.4

actions/setup-python (actions/setup-python)

v5.1.1

Compare Source

What's Changed

Bug fixes:

• fix(ci): update all failing workflows by @​mayeut in https://github.com/actions/setup-python/pull/863
  This update ensures compatibility and optimal performance of workflows on the latest macOS version.

Documentation changes:

• Documentation update for cache by @​gowridurgad in https://github.com/actions/setup-python/pull/873

Dependency updates:

• Bump braces from 3.0.2 to 3.0.3 and undici from 5.28.3 to 5.28.4 by @​dependabot in https://github.com/actions/setup-python/pull/893

New Contributors

• @​gowridurgad made their first contribution in https://github.com/actions/setup-python/pull/873

Full Changelog: actions/setup-python@v5...v5.1.1

pylint-dev/pylint (pylint)

v3.2.6

Compare Source

What's new in Pylint 3.2.6?

Release date: 2024-07-21

False Positives Fixed

• Quiet false positives for unexpected-keyword-arg when pylint cannot
  determine which of two or more dynamically defined classes is being instantiated.

  Closes #​9672

• Fix a false positive for missing-param-doc where a method which is decorated with typing.overload was expected to have a docstring specifying its parameters.

  Closes #​9739

• Fix a regression that raised invalid-name on class attributes merely
  overriding invalid names from an ancestor.

  Closes #​9765

• Treat assert_never() the same way when imported from typing_extensions.

  Closes #​9780

• Fix a false positive for consider-using-min-max-builtin when the assignment target is an attribute.

  Refs #​9800

Other Bug Fixes

• Fix an AssertionError arising from properties that return partial functions.

  Closes #​9214

• Fix a crash when a subclass extends __slots__.

  Closes #​9814

step-security/harden-runner (step-security/harden-runner)

v2.9.0

Compare Source

What's Changed

Release v2.9.0 by @​h0x0er and @​varunsh-coder in https://github.com/step-security/harden-runner/pull/435
This release includes:

• Enterprise Tier - Telemetry Upload Enhancement:
  For the enterprise tier, this change helps overcome size constraints, allowing for more reliable telemetry uploads from the Harden-Runner agent to the StepSecurity backend API. No configuration change is needed to enable this.
• Harden-Runner Agent Authentication:
  The Harden-Runner agent now uses a per-job key to authenticate to the StepSecurity backend API to submit telemetry. This change prevents the submission of telemetry data anonymously for a given job, improving the integrity of the data collection process. No configuration change is needed to enable this.
• README Update:
  A Table of Contents has been added to the README file to improve navigation. This makes it easier for users to find the information they need quickly.
• Dependency Update:
  Updated the braces npm package dependency to a non-vulnerable version. The vulnerability in braces did not affect the Harden Runner Action

Full Changelog: step-security/harden-runner@v2...v2.9.0

tox-dev/tox (tox)

v4.16.0

Compare Source

What's Changed

• Fix two small documentation issues by @​srenfo in https://github.com/tox-dev/tox/pull/3297
• Fix tests after new setuptools by @​gaborbernat in https://github.com/tox-dev/tox/pull/3299
• Add windir to the default list of pass_env variables on Windows by @​kurtmckee in https://github.com/tox-dev/tox/pull/3303

New Contributors

• @​srenfo made their first contribution in https://github.com/tox-dev/tox/pull/3297

Full Changelog: tox-dev/tox@4.15.1...4.16.0

---

Configuration

📅 Schedule: Branch creation - "every month" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}