chore(deps): update all patch versions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/create-github-app-token	action	patch	v2.1.1 -> v2.1.4
apple/swift-metrics		patch	from: "2.7.0" -> from: "2.7.1"
apple/swift-nio		patch	from: "2.86.0" -> from: "2.86.2"
github/codeql-action	action	patch	v3.30.3 -> v3.30.7
ossf/scorecard-action	action	patch	v2.4.2 -> v2.4.3

---

Release Notes

actions/create-github-app-token (actions/create-github-app-token)

v2.1.4

Compare Source

Bug Fixes

• deps: bump @​octokit/auth-app from 7.2.1 to 8.0.1 (#​257) (bef1eaf)

v2.1.3

Compare Source

Bug Fixes

• deps: bump undici from 7.8.0 to 7.10.0 in the production-dependencies group (#​254) (f3d5ec2)

v2.1.2

Compare Source

Bug Fixes

• deps: bump @​octokit/request from 9.2.3 to 10.0.2 (#​256) (5d7307b)

apple/swift-metrics (apple/swift-metrics)

v2.7.1

Compare Source

What's Changed

SemVer Patch

• Update TestMetrics.swift by @​rnro in #​177
• TestMetrics.FullKey hash goes via Dictionary by @​rnro in #​179

Other Changes

• Enable release mode builds by @​josephnoir in #​175
• Update README.md by @​PaulRWillis in #​180
• doc updates - formatting, organization, and language by @​heckj in #​178

New Contributors

• @​josephnoir made their first contribution in #​175
• @​PaulRWillis made their first contribution in #​180
• @​heckj made their first contribution in #​178

Full Changelog: apple/swift-metrics@2.7.0...2.7.1

apple/swift-nio (apple/swift-nio)

v2.86.2

Compare Source

What's Changed

SemVer Patch

• The formatter changed its mind by @​Lukasa in #​3379
• Add back NIOFileSystem by @​glbrntt in #​3380

Other Changes

• Static sdk allow custom args by @​rnro in #​3377

Full Changelog: apple/swift-nio@2.86.1...2.86.2

v2.86.1: SwiftNIO 2.86.1

Compare Source

What's Changed

SemVer Patch

• [Windows] Ensure ssize_t and socklen_t are available by @​fabianfett in #​3337
• [Windows] Add msghdr extension for Windows by @​fabianfett in #​3336
• [Windows] Ensure NIOHTTP1 compiles by @​fabianfett in #​3338
• Drop all server response parts after an invalid header by @​glbrntt in #​3339
• [Windows] Make Thread.swift compile by @​fabianfett in #​3341
• [Windows] Make ControlMessage.swift compile by @​fabianfett in #​3342
• [Windows] Map naming conventions Windows -> Posix (ssize_t) by @​fabianfett in #​3343
• [Windows] Make SelectableEventLoop compile by @​fabianfett in #​3344
• [Windows] Fix deprecation warnings in NIOCore by @​fabianfett in #​3345
• [Windows] fatalError concurrency takeover by @​fabianfett in #​3347
• [Windows] Make SocketChannel.swift compile by @​fabianfett in #​3348
• [Windows] Use WSASend as writev equivalent by @​fabianfett in #​3350
• [Windows] Fix getenv warnings in NIOPosix and NIOEmbedded by @​fabianfett in #​3351
• [Windows] dup is deprecated on Windows, use _dup instead by @​fabianfett in #​3352
• [Windows] Add shims to make string from GetLastError using FormatMessage by @​fabianfett in #​3353
• [Windows] Allow _SelectorBackendProtocol to work with Windows Handles by @​fabianfett in #​3356
• [Windows] Use recv instead of read by @​fabianfett in #​3357
• [Windows] Disable Pipelines for now (fatalError) by @​fabianfett in #​3358
• SelectableEventLoop.debugDescription: fix debugDescription deadlock by @​weissi in #​3360
• [Windows] Return false from concurrency takeover by @​fabianfett in #​3362
• [Windows] Make SelectorGeneric compile on Windows by @​fabianfett in #​3359
• [Windows] Reimplement pread by @​fabianfett in #​3361
• [Windows] Sleep instead of WSAPoll, if no outstanding IO by @​fabianfett in #​3365
• [Windows] Reimplement pwrite by @​fabianfett in #​3364
• [Windows] Ensure WSAStartup is correctly called. by @​fabianfett in #​3366
• Remove NIOFileSystem from products by @​glbrntt in #​3370
• Miscellaneous rearrangements of NIOFileSystem by @​aryan-25 in #​3333, by @​glbrntt in #​3363, and by @​glbrntt in #​3367

Other Changes

• Add Android imports for some new tests in #​3308 that require it by @​finagolfin in #​3334
• Make testMetricsDelegateTickInfo less flaky by @​glbrntt in #​3335
• [wasm][2/2] Include WebAssembly SDK checks in PR and main workflows by @​kateinoigakukun in #​3332
• Use path based deps in the alloc counter framework by @​glbrntt in #​3355
• Add Xcode 26.0, 16.4 CI, remove 16.2 by @​rnro in #​3375
• Update CI scripts for 6.2 by @​fabianfett in #​3374

Full Changelog: apple/swift-nio@2.86.0...2.87.0

github/codeql-action (github/codeql-action)

v3.30.7

Compare Source

v3.30.6

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.6 - 02 Oct 2025

• Update default CodeQL bundle version to 2.23.2. #​3168

See the full CHANGELOG.md for more information.

v3.30.5

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.5 - 26 Sep 2025

• We fixed a bug that was introduced in 3.30.4 with upload-sarif which resulted in files without a .sarif extension not getting uploaded. #​3160

See the full CHANGELOG.md for more information.

v3.30.4

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.4 - 25 Sep 2025

• We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the codeql-action/init step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the codeql-action/init step. #​3099 and #​3100
• We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. #​3107
• You can now run the latest CodeQL nightly bundle by passing tools: nightly to the init action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. #​3130
• Update default CodeQL bundle version to 2.23.1. #​3118

See the full CHANGELOG.md for more information.

ossf/scorecard-action (ossf/scorecard-action)

v2.4.3

Compare Source

What's Changed

This update bumps the Scorecard version to the v5.3.0 release. For a complete list of changes, please refer to the Scorecard v5.3.0 release notes.

Documentation

• docs: clarify GITHUB_TOKEN permissions needed for private repos by @​pankajtaneja5 in #​1574
• 📖 Fix recommended command to test the image in development by @​deivid-rodriguez in #​1583

Other

• add missing top-level token permissions to workflows by @​timothyklee in #​1566
• setup codeowners for requesting reviews by @​spencerschrock in #​1576
• 🌱 Improve printing options by @​deivid-rodriguez in #​1584

New Contributors

• @​timothyklee made their first contribution in #​1566
• @​pankajtaneja5 made their first contribution in #​1574
• @​deivid-rodriguez made their first contribution in #​1584

Full Changelog: ossf/scorecard-action@v2.4.2...v2.4.3

---

Configuration

📅 Schedule: Branch creation - "before 8am every weekday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.