ci(deps): bump voidzero-dev/setup-vp from 1.21.1 to 1.21.2 in the github-actions group

[dependabot]

Bumps the github-actions group with 1 update: voidzero-dev/setup-vp.

Updates voidzero-dev/setup-vp from 1.21.1 to 1.21.2

Release notes

Sourced from voidzero-dev/setup-vp's releases.

v1.21.2

This patch release fixes command injection in GitLab inputs and Azure setupRef. GitLab and Azure now validate refs before downloading bootstrap scripts or runtimes.

The installer also prevents executable planting during sfw lookup. All integrations use Socket Firewall Free v1.15.4.

Registry authentication now requires an explicit registry-url input (registryUrl in Azure) or an existing auth entry in .npmrc. Jobs that previously relied on automatic token entries from registry URLs in repository files must update their configuration.

This release also isolates bundle rebuilds from the GitHub App token, expands native operating system test coverage, and updates dependencies.

What's Changed

• chore: upgrade Vite+ to 1.0.0-rc.0 by @​fengmk2 in voidzero-dev/setup-vp#173
• chore(deps): update pnpm to v12 by @​renovate[bot] in voidzero-dev/setup-vp#179
• chore(deps): update github actions (major) by @​renovate[bot] in voidzero-dev/setup-vp#176
• chore(deps): update vite-plus to v1.0.0 by @​renovate[bot] in voidzero-dev/setup-vp#174
• chore(deps): update dependency @​actions/cache to v6.3.0 by @​renovate[bot] in voidzero-dev/setup-vp#181
• chore(deps): update dependency socketdev/sfw-free to v1.15.4 by @​renovate[bot] in voidzero-dev/setup-vp#180
• chore(deps): update dependency vite-plus to v1 by @​renovate[bot] in voidzero-dev/setup-vp#177
• chore(deps): update pnpm package manager by @​renovate[bot] in voidzero-dev/setup-vp#178
• chore(deps): update vite-plus to v1.1.0 by @​renovate[bot] in voidzero-dev/setup-vp#182
• fix: prevent Azure setupRef command injection by @​fengmk2 in voidzero-dev/setup-vp#184
• ci: run the full unit suite on all supported operating systems by @​fengmk2 in voidzero-dev/setup-vp#185
• fix: isolate bundle rebuilds from the app token by @​fengmk2 in voidzero-dev/setup-vp#187
• fix: validate refs before CI bootstrap downloads by @​fengmk2 in voidzero-dev/setup-vp#188
• fix: publish rebuilt bundles from a trusted workflow by @​fengmk2 in voidzero-dev/setup-vp#189
• fix: require explicit registry input for generated auth by @​fengmk2 in voidzero-dev/setup-vp#191
• fix: prevent executable planting during sfw lookup by @​fengmk2 in voidzero-dev/setup-vp#190
• fix: prevent shell injection through GitLab inputs by @​fengmk2 in voidzero-dev/setup-vp#193

Full Changelog: voidzero-dev/setup-vp@v1.21.1...v1.21.2

Commits

• 68f39c7 chore: release v1.21.2 (#195)
• 16e60ef fix: prevent shell injection through GitLab inputs (#193)
• 77e445c fix: prevent executable planting during sfw lookup (#190)
• 2fb3264 fix: require explicit registry input for generated auth (#191)
• 264e3f5 fix: publish rebuilt bundles from a trusted workflow (#189)
• 38584ab fix: validate refs before CI bootstrap downloads (#188)
• a0eccbf fix: isolate bundle rebuilds from the app token (#187)
• 9706c5f ci: run the full unit suite on all supported operating systems (#185)
• ad9155c fix: prevent Azure setupRef command injection (#184)
• 3e9ae84 chore(deps): update vite-plus to v1.1.0 (#182)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.25%. Comparing base (564391a) to head (63cf542).
⚠️ Report is 16 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1732   +/-   ##
=======================================
  Coverage   83.25%   83.25%           
=======================================
  Files          62       62           
  Lines         842      842           
  Branches      151      151           
=======================================
  Hits          701      701           
  Misses         16       16           
  Partials      125      125           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.