build(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3

[dependabot]

Bumps goreleaser/goreleaser-action from 7.2.2 to 7.2.3.

Release notes

Sourced from goreleaser/goreleaser-action's releases.

v7.2.3

What's Changed

• ci(deps): bump the actions group with 3 updates by @​dependabot[bot] in goreleaser/goreleaser-action#563
• chore(deps): bump undici from 6.24.1 to 6.27.0 by @​dependabot[bot] in goreleaser/goreleaser-action#565
• build: regenerate dist after undici 6.27.0 bump by @​caarlos0 in goreleaser/goreleaser-action#567
• ci: auto-rebuild dist on dependabot PRs by @​caarlos0 in goreleaser/goreleaser-action#568
• ci: use a GitHub App token to rebuild dist on dependabot PRs by @​caarlos0 in goreleaser/goreleaser-action#569

Full Changelog: goreleaser/goreleaser-action@v7.2.2...v7.2.3

Commits

• f06c13b chore: update dist
• d393459 ci: fix job
• ee731b1 chore: workflow dispatch
• 55de448 chore(deps): bump js-yaml from 4.1.1 to 4.2.0
• a4f614e ci: use a GitHub App token to rebuild dist on dependabot PRs (#569)
• d2d17a6 ci: auto-rebuild dist on dependabot PRs (#568)
• d13def3 build: regenerate dist after undici 6.27.0 bump (#567)
• 21549b6 chore(deps): bump undici from 6.24.1 to 6.27.0 (#565)
• 47c416d ci(deps): bump the actions group with 3 updates (#563)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[masutaka]

Overview

• Package: goreleaser/goreleaser-action 7.2.2 → 7.2.3
• Dependency type: development dependency (a GitHub Action used only by the release workflow)
• Version change: patch

Key findings

• Breaking changes: none. All 9 upstream commits are CI maintenance, dependency bumps, and dist regeneration. action.yml does not appear in the compare's changed-file list, so it is untouched, and no input parameters were added or removed.
• Security: this repository has 0 open Dependabot alerts, so this is a routine version bump, not an alert-driven one. That said, the upstream bundled dependencies were updated, which incidentally resolves the following (all transitive dependencies that never surface as alerts on this repository):
  • undici 6.24.1 → 6.27.0
    • GHSA-vxpw-j846-p89q / CVE-2026-12151 (high, WebSocket DoS, fixed in 6.27.0)
    • GHSA-p88m-4jfj-68fv / CVE-2026-9679 (medium, HTTP header injection via Set-Cookie, fixed in 6.27.0)
    • GHSA-g8m3-5g58-fq7m / CVE-2026-11525 (low, SameSite downgrade, fixed in 6.27.0)
    • GHSA-35p6-xmwp-9g52 / CVE-2026-6733 (low, response queue poisoning via keep-alive socket reuse, fixed in 6.27.0)
  • js-yaml 4.1.1 → 4.3.0
    • GHSA-52cp-r559-cp3m / CVE-2026-59869 (high, quadratic-complexity DoS via merge-key chains, fixed in 4.3.0)
    • GHSA-h67p-54hq-rp68 / CVE-2026-53550 (medium, same class of merge-key DoS, fixed in 4.2.0)
  • Practical impact is minimal in every case. The WebSocket and Set-Cookie issues are never exercised by this usage, which only downloads the goreleaser binary, and the only YAML js-yaml parses here is this repository's own trusted config file.
• Supported versions: unchanged. action.yml is untouched so the Node runtime declaration stays as is, and undici's engines remains node >=18.17.
• CI status: pass (actionlint, test, CodeQL (actions), and dependency_review all succeeded; the main CodeQL job, pushover, and add-assignee are conditionally skipped).
• Cascading updates: the only change on this repository's side is a single line in .github/workflows/release.yml (+1/-1). The upstream-internal undici and js-yaml bumps are already bundled into dist and do not propagate into our manifests.

Scope of impact

This only swaps the goreleaser/goreleaser-action pin at .github/workflows/release.yml:59 from SHA 5daf1e9 (v7.2.2) to f06c13b (v7.2.3). Because it runs with with: install-only: true, the action merely puts the goreleaser binary on PATH while the actual release work is done by later steps. There is no impact whatsoever on the application code (the Go side); this concerns only the release workflow triggered by a tag push.

Upstream release diff review

• The pinned SHA f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 matches the commit that the upstream v7.2.3 tag points to.
• All 9 commits are signature-verified (verified: true). The only authors are dependabot[bot] and goreleaser maintainer caarlos0.
• Fetching and comparing dist/index.js at v7.2.2 and v7.2.3 shows:
  • Most of the diff is minifier variable renaming (E ↔ f and similar), with a size increase of roughly 8.5 KB — consistent with the undici and js-yaml updates.
  • Zero newly introduced URLs and zero embedded raw IP addresses.
  • Occurrence counts for child_process, execSync, eval(, Function(, and Buffer.from(..., "base64") are identical to v7.2.2 (1 / 1 / 0 / 11 / 1 respectively).
• No postinstall, preinstall, bin, or scripts additions or changes either — the package.json diff consists solely of the js-yaml version range and a removed blank line.

Note that this is a diff over git tags; it does not guarantee that the registry tarball matches, nor the absence of obfuscated or time-triggered code.

Open questions

• The Release notes section of the PR body does not list the js-yaml 4.1.1 → 4.3.0 update. That is because the auto-generated notes only pick up commits that came through PRs; the change is present in the tag (commit 55de448). The actual content has been verified as described above.
• package.json specifies js-yaml: ^4.2.0 while the lockfile resolves to 4.3.0. This is valid within the caret range — upstream's intent was to pin 4.2.0, and the lockfile was subsequently bumped to 4.3.0.

Verdict

No issues

This is a patch-level update, and the only change on our side is a single SHA pin line in release.yml. CI passes across the board. The pinned SHA matches the upstream v7.2.3 tag, every commit is signed and authored by known maintainers, and the bundled dist/index.js shows no new URLs, IPs, or increase in execution-related APIs. It additionally resolves several DoS and injection vulnerabilities in undici and js-yaml, so it is safe to merge.