chore(deps): update submodules (#5265)

renovate-bot · web-flow · commit 92a36c9f32e2 · 2026-04-22T12:00:05.000+10:00
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/upload-artifact](https://redirect.github.com/actions/upload-artifact) | action | patch | `v7.0.0` → `v7.0.1` | | [gcp/api/googleapis](https://redirect.github.com/googleapis/googleapis) ([changelog](https://redirect.github.com/googleapis/googleapis/compare/bf85cad8abc13cd38d42b0cf8545d323243ff7e2..939ba3bf8408af83f0f73ae35c76c4b11a8c8c8d)) | | digest | `bf85cad` → `939ba3b` | | [peter-evans/create-pull-request](https://redirect.github.com/peter-evans/create-pull-request) | action | patch | `v8.1.0` → `v8.1.1` | | [zizmorcore/zizmor-action](https://redirect.github.com/zizmorcore/zizmor-action) | action | patch | `v0.5.2` → `v0.5.3` | --- ### Release Notes <details> <summary>actions/upload-artifact (actions/upload-artifact)</summary> ### [`v7.0.1`](https://redirect.github.com/actions/upload-artifact/releases/tag/v7.0.1) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v7...v7.0.1) ##### What's Changed - Update the readme with direct upload details by [@&#8203;danwkennedy](https://redirect.github.com/danwkennedy) in [#&#8203;795](https://redirect.github.com/actions/upload-artifact/pull/795) - Readme: bump all the example versions to v7 by [@&#8203;danwkennedy](https://redirect.github.com/danwkennedy) in [#&#8203;796](https://redirect.github.com/actions/upload-artifact/pull/796) - Include changes in typespec/ts-http-runtime 0.3.5 by [@&#8203;yacaovsnc](https://redirect.github.com/yacaovsnc) in [#&#8203;797](https://redirect.github.com/actions/upload-artifact/pull/797) **Full Changelog**: <actions/upload-artifact@v7...v7.0.1> </details> <details> <summary>peter-evans/create-pull-request (peter-evans/create-pull-request)</summary> ### [`v8.1.1`](https://redirect.github.com/peter-evans/create-pull-request/releases/tag/v8.1.1): Create Pull Request v8.1.1 [Compare Source](https://redirect.github.com/peter-evans/create-pull-request/compare/v8.1.0...v8.1.1) #### What's Changed - build(deps-dev): bump the npm group with 2 updates by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;4305](https://redirect.github.com/peter-evans/create-pull-request/pull/4305) - build(deps): bump minimatch by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;4311](https://redirect.github.com/peter-evans/create-pull-request/pull/4311) - build(deps): bump the github-actions group with 2 updates by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;4316](https://redirect.github.com/peter-evans/create-pull-request/pull/4316) - build(deps): bump [@&#8203;tootallnate/once](https://redirect.github.com/tootallnate/once) and jest-environment-jsdom by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;4323](https://redirect.github.com/peter-evans/create-pull-request/pull/4323) - build(deps-dev): bump undici from 6.23.0 to 6.24.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;4328](https://redirect.github.com/peter-evans/create-pull-request/pull/4328) - build(deps-dev): bump flatted from 3.3.1 to 3.4.2 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;4334](https://redirect.github.com/peter-evans/create-pull-request/pull/4334) - build(deps): bump picomatch by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;4339](https://redirect.github.com/peter-evans/create-pull-request/pull/4339) - build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;4344](https://redirect.github.com/peter-evans/create-pull-request/pull/4344) - build(deps-dev): bump the npm group with 3 updates by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;4349](https://redirect.github.com/peter-evans/create-pull-request/pull/4349) - fix: retry post-creation API calls on 422 eventual consistency errors by [@&#8203;peter-evans](https://redirect.github.com/peter-evans) in [#&#8203;4356](https://redirect.github.com/peter-evans/create-pull-request/pull/4356) **Full Changelog**: <peter-evans/create-pull-request@v8.1.0...v8.1.1> </details> <details> <summary>zizmorcore/zizmor-action (zizmorcore/zizmor-action)</summary> ### [`v0.5.3`](https://redirect.github.com/zizmorcore/zizmor-action/releases/tag/v0.5.3) [Compare Source](https://redirect.github.com/zizmorcore/zizmor-action/compare/v0.5.2...v0.5.3) #### What's Changed - `1.24.0` and `1.24.1` are now available via the action - `1.24.1` is now the default version of zizmor used by the action **Full Changelog**: <zizmorcore/zizmor-action@v0.5.2...v0.5.3> </details> --- ### Configuration 📅 **Schedule**: (in timezone Australia/Sydney) - Branch creation - "before 6am on wednesday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/google/osv.dev).
diff --git a/.github/workflows/generate-protos.yml b/.github/workflows/generate-protos.yml
@@ -65,7 +65,7 @@ jobs:
         run: make build-protos
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.PR_TOKEN_BOT }}
           title: "chore: regenerate protos"
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
@@ -42,7 +42,7 @@ jobs:
 
       # Upload the results as artifacts (optional).
       - name: "Upload artifact"
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: SARIF file
           path: results.sarif
diff --git a/.github/workflows/snapshots.yml b/.github/workflows/snapshots.yml
@@ -33,7 +33,7 @@ jobs:
         env:
           OSV_API_BASE_URL: api.test.osv.dev
           UPDATE_SNAPS: always
-      - uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+      - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.PR_TOKEN_BOT }}
           title: "test: update apitester snapshots"
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
@@ -20,4 +20,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
diff --git a/gcp/api/googleapis b/gcp/api/googleapis
@@ -1 +1 @@
-Subproject commit bf85cad8abc13cd38d42b0cf8545d323243ff7e2
+Subproject commit 939ba3bf8408af83f0f73ae35c76c4b11a8c8c8d
