chore(deps): update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
anchore/sbom-action	action	patch	v0.24.0 → v0.24.2
anchore/scan-action	action	patch	v7.4.0 → v7.4.2
github/codeql-action	action	patch	v4.37.8 → v4.37.9
zizmorcore/zizmor-action	action	patch	v0.6.2 → v0.6.3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

anchore/sbom-action (anchore/sbom-action)

v0.24.2

Compare Source

Added Features

• bump eslint from 10.8.1 to 10.9.0 [#​724 @​dependabot]

Additional Changes

• add makefile target to bump syft [#​620 @​willmurphyscode]
• update zizmor workflow triggers [#​624 @​wagoodman]
• require zizmor security events [#​621 @​wagoodman]

(Full Changelog)

v0.24.1

Compare Source

anchore/scan-action (anchore/scan-action)

v7.4.2

Compare Source

Additional Changes

• ops: write contents for release [#​756 @​spiffcs]
• add makefile target to bump grype version [#​639 @​willmurphyscode]
• update zizmor workflow triggers [#​642 @​wagoodman]
• require zizmor security events [#​640 @​wagoodman]

(Full Changelog)

v7.4.1

Compare Source

github/codeql-action (github/codeql-action)

v4.37.9

Compare Source

• Update default CodeQL bundle version to 2.26.4. #​4106

zizmorcore/zizmor-action (zizmorcore/zizmor-action)

v0.6.3

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[toolhive-release-app]

🛡️ Skill Security Scan Results

✅ agent-observability-eval-bootstrap

• Status: Passed
• Findings: 9
• Allowed (not blocking): 9
  • ATR_2026_00066 (Allowed: FP: matched Datadog eval-prompt template placeholders — {{input_data}}, {{output_data}}, {{span_input}}, {{meta.input.messages[*].content}}. These are the documented templating syntax for LLM-judge prompts, not injected payloads. datadog-labs/agent-skills @9bcb3ce.)
  • ATR_2026_00066 (Allowed: FP: matched Datadog eval-prompt template placeholders — {{input_data}}, {{output_data}}, {{span_input}}, {{meta.input.messages[*].content}}. These are the documented templating syntax for LLM-judge prompts, not injected payloads. datadog-labs/agent-skills @9bcb3ce.)
  • ATR_2026_00066 (Allowed: FP: matched Datadog eval-prompt template placeholders — {{input_data}}, {{output_data}}, {{span_input}}, {{meta.input.messages[*].content}}. These are the documented templating syntax for LLM-judge prompts, not injected payloads. datadog-labs/agent-skills @9bcb3ce.)
  • ATR_2026_00066 (Allowed: FP: matched Datadog eval-prompt template placeholders — {{input_data}}, {{output_data}}, {{span_input}}, {{meta.input.messages[*].content}}. These are the documented templating syntax for LLM-judge prompts, not injected payloads. datadog-labs/agent-skills @9bcb3ce.)
  • ATR_2026_00066 (Allowed: FP: matched Datadog eval-prompt template placeholders — {{input_data}}, {{output_data}}, {{span_input}}, {{meta.input.messages[*].content}}. These are the documented templating syntax for LLM-judge prompts, not injected payloads. datadog-labs/agent-skills @9bcb3ce.)
  • ATR_2026_00066 (Allowed: FP: matched Datadog eval-prompt template placeholders — {{input_data}}, {{output_data}}, {{span_input}}, {{meta.input.messages[*].content}}. These are the documented templating syntax for LLM-judge prompts, not injected payloads. datadog-labs/agent-skills @9bcb3ce.)
  • ATR_2026_00066 (Allowed: FP: matched Datadog eval-prompt template placeholders — {{input_data}}, {{output_data}}, {{span_input}}, {{meta.input.messages[*].content}}. These are the documented templating syntax for LLM-judge prompts, not injected payloads. datadog-labs/agent-skills @9bcb3ce.)
  • ATR_2026_00066 (Allowed: FP: matched Datadog eval-prompt template placeholders — {{input_data}}, {{output_data}}, {{span_input}}, {{meta.input.messages[*].content}}. These are the documented templating syntax for LLM-judge prompts, not injected payloads. datadog-labs/agent-skills @9bcb3ce.)
  • ATR_2026_00066 (Allowed: FP: matched Datadog eval-prompt template placeholders — {{input_data}}, {{output_data}}, {{span_input}}, {{meta.input.messages[*].content}}. These are the documented templating syntax for LLM-judge prompts, not injected payloads. datadog-labs/agent-skills @9bcb3ce.)

---

Summary: Scanned 1 skill(s), all passed security checks. ✅

[toolhive-release-app]

🔒 MCP Security Scan Results

✅ adb-mysql-mcp-server

• Status: Passed
• Tools scanned: 3
• Result: No security issues detected

✅ agentql-mcp

• Status: Passed
• Tools scanned: 1
• Result: No security issues detected

---

Summary: Scanned 2 MCP server(s), all passed security checks. ✅