chore(deps): Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
antsibull-docs (changelog)	==2.25.0 → ==2.26.0				minor
arillso/.github	2026-08-14 → 2026-08-16				patch	2026-08-18 (+1)
python (source)	3a9d2dd → 4fad234			final	digest
python (source)	3a9d2dd → 4fad234			stage	digest

---

Release Notes

ansible-community/antsibull-docs (antsibull-docs)

v2.26.0

Compare Source

Release Summary

Maintenance release.

Minor Changes

• antsibull-docs now requires pydantic 2.12+ (#​473).

arillso/.github (arillso/.github)

v2026-08-16

Compare Source

Fixed

• security-code.yml derives the Go toolchain from go.mod instead of a
  hardcoded default. The go-version input defaulted to 1.25, which silently
  applied to every consumer that omitted it, and the only way to avoid it was to
  repeat the version as a literal — arillso/go.ansible carried exactly that,
  with a comment asking the next reader to keep it in sync with go.mod by hand.
  That sync point is what let the Go 1.26.5 stdlib advisories (GO-2026-5026,
  -5942, -5972, -6088, -6089, -6090, -6091, -6218) sit unnoticed in the CodeQL
  job. go-version now defaults to empty and a new go-version-file input
  (default go.mod) takes over, mirroring how security-deps.yml has always
  resolved its toolchain. Consumers that pass an explicit go-version keep it;
  the input still wins when set. When neither applies — no go-version and no
  go-version-file on disk — the job falls back to stable rather than failing
  in Setup Go, so a Go repository whose module does not sit at the workspace
  root still runs. security-deps.yml guards the same way.

• security-code.yml, security-config.yml, security-sbom.yml,
  ci-ansible-molecule.yml and release-go.yml give their concurrency
  group a static per-workflow discriminator. Inside a workflow_call reusable
  github.workflow and github.ref resolve to the caller, so a bare
  ${{ github.workflow }}-${{ github.ref }} group is byte-identical to the
  group the calling workflow declares for itself. With cancel-in-progress
  defaulting to true the job was dropped at scheduling time — no job record,
  no annotation, no log, just a run reporting failure while every job it did
  create is green. The nightly security scans of arillso/go.ansible and
  arillso/action.playbook lost their CodeQL job this way from 2026-08-12, the
  day they moved from security-codeql.yml to security-code.yml.
  security-secrets.yml and ci-go.yml already carried this fix; these five
  did not. Consumers pick it up with the next preset tag.

• renovate-ansible.json gives the Molecule platform images customManager
  an autoReplaceStringTemplate, so the pinDigests rule that sits next to it
  can actually pin. Renovate's field-wise rewrite path only rewrites tokens the
  matched line already holds: pinning a bare :latest leaves currentValue
  unchanged and has no currentDigest to swap, so the line came back
  byte-identical, confirmIfDepUpdated found no digest, and the branch was
  discarded with Error updating branch: update failure — all eight molecule
  pins in arillso/ansible.agent failed this way. A template is the only path
  that can add a token, and it reproduces the whole match (image: prefix and
  trailing newline included) because replaceAt swaps the match as a unit; the
  matchStrings regex is unchanged. The digest slot is guarded by
  {{#if newDigest}} so a plain tag update does not emit a bare @. One known
  ceiling: the template writes the value unquoted with a single space after
  image:, so a quoted value would lose its quotes — still valid YAML, and no
  molecule scenario in the consuming repositories uses that form. Consumers pick
  the fix up when the preset tag they extend moves forward.

Added

• pull-request.yml gains a renovate-molecule-manager job backed by
  scripts/tests/test-renovate-molecule-manager.sh. The check is a round trip
  rather than a string comparison: the unpinned image: line has to match the
  manager's regex, the rendered template has to match that same regex again, and
  the digest has to come back out of it — which is exactly the re-extraction
  confirmIfDepUpdated performs and exactly the step that failed. Regex and
  template are read out of the JSON with jq instead of restated, so the guard
  cannot drift away from the preset it guards. Without it the manager stays in a
  JSON no CI parses, and a template lost to a later edit would first surface as
  a failing Renovate run on a downstream repository.

v2026-08-15

Compare Source

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "before 6am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ❌ 1 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

License Issues

requirements.txt

Package	Version	License	Issue Type
antsibull-docs	2.26.0	GPL-3.0-or-later	Incompatible License

Allowed Licenses:

Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MIT, 0BSD, CC0-1.0

OpenSSF Scorecard

Package	Version	Score	Details
pip/antsibull-docs	2.26.0	Unknown	Unknown

Scanned Files

• requirements.txt