chore(deps): update all digest updates

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
dependabot/fetch-metadata (changelog)	action	digest	21025c7 → ffa630c
github/codeql-action (changelog)	action	digest	0d579ff → c10b806

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

✅⚠️MegaLinter analysis: Success with warnings

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	3		0	0	0.06s
✅ COPYPASTE	jscpd	yes		no	no	1.29s
✅ EDITORCONFIG	editorconfig-checker	3		0	0	0.02s
⚠️ REPOSITORY	checkov	yes		no	1	22.52s
✅ REPOSITORY	gitleaks	yes		no	no	0.47s
✅ REPOSITORY	git_diff	yes		no	no	0.01s
✅ REPOSITORY	grype	yes		no	no	40.73s
⚠️ REPOSITORY	kics	yes		no	1	3.5s
✅ REPOSITORY	secretlint	yes		no	no	1.52s
✅ REPOSITORY	semgrep	yes		no	no	26.37s
✅ REPOSITORY	syft	yes		no	no	1.87s
✅ REPOSITORY	trivy	yes		no	no	10.95s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.22s
✅ REPOSITORY	trufflehog	yes		no	no	3.61s
✅ SPELL	lychee	3		0	0	0.51s
✅ YAML	prettier	3	0	0	0	0.5s
✅ YAML	v8r	3		0	0	3.13s
✅ YAML	yamllint	3		0	0	0.48s

Detailed Issues

⚠️ REPOSITORY / checkov - 1 warning

error: Ensure the base image uses a non latest version tag
  ┌─ Dockerfile:9:1
  │
9 │ FROM ${BASE_IMAGE} AS base
  │ ^^^^^^^^^^^^^^^^^^^^^^^^^^
  │
  = Ensure the base image uses a non latest version tag
  = Ensure the base image uses a non latest version tag

error: Ensure that sudo isn't used
   ┌─ Dockerfile:40:1
   │  
40 │ ╭ RUN useradd --create-home libraries && usermod --lock libraries && \
41 │ │     # Warning: the created user has root permissions inside the container
42 │ │     # Warning: you still need to start the ssh process with `sudo service ssh start`
43 │ │     if ! id -u ubuntu; then useradd --create-home --shell /bin/bash --groups sudo ubuntu; fi
   │ ╰────────────────────────────────────────────────────────────────────────────────────────────^
   │  
   = Ensure that sudo isn't used
   = Ensure that sudo isn't used

error: Ensure that sudo isn't used
   ┌─ Dockerfile:56:1
   │  
56 │ ╭ RUN apt-get update && \
57 │ │     apt-get install --yes --no-install-recommends \
58 │ │     # minimal
59 │ │     bash \
   · │
75 │ │     git \
76 │ │     && rm -rf /var/lib/apt/lists/*
   │ ╰──────────────────────────────────^
   │  
   = Ensure that sudo isn't used
   = Ensure that sudo isn't used

warning: Ensure that a user for the container has been created
    ┌─ Dockerfile:1:1
    │  
  1 │ ╭ # hadolint global ignore=DL3008
  2 │ │ # kics-scan disable=fd54f200-402c-4333-a5a4-36ef6709af2f,965a08d7-ef86-4f14-8792-4a3b2098937e
  3 │ │ # checkov:skip=CKV_DOCKER_3
  4 │ │ ARG BASE_IMAGE=public.ecr.aws/ubuntu/ubuntu:24.04@sha256:b1940c8ecf8ff591053cc5db0303fb882f9fafec50f26892a870bcbe1b30d25a
    · │
111 │ │ 
112 │ │ HEALTHCHECK CMD ["uv", "pip", "list"]
    │ ╰─────────────────────────────────────^
    │  
    = Ensure that a user for the container has been created
    = Ensure that a user for the container has been created

warning: 1 warnings emitted
error: 3 errors emitted

⚠️ REPOSITORY / kics - 1 warning

warning: RUN instruction uv venv "/databricks/python3" --seed &&     uv pip install --no-cache-dir --requirements requirements.txt pyspark=="4.0.0" &&     uv pip uninstall pyspark &&     uv pip list does not use package pinning form
   ┌─ Dockerfile:94:1
   │
94 │ FROM base AS build
   │ ^^^^^^^^^^^^^^^^^^
   │
   = Unpinned Package Version in Pip Install
   = Package version pinning reduces the range of versions that can be installed, reducing the chances of failure due to unanticipated changes

warning: 1 warnings emitted

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

Show us your support by starring ⭐ the repository