[renovate]

This PR contains the following updates:

Package	Type	Update	Change
python (source)	final	digest	86df5c8 → d650864
rules_cc	bazel_dep	patch	0.2.27 → 0.2.28
step-security/harden-runner	action	patch	v2.22.3 → v2.22.4

---

Release Notes

bazelbuild/rules_cc (rules_cc)

v0.2.28

Compare Source

Using bzlmod with Bazel 6 or later:

1. [Bazel 6] Add common --enable_bzlmod to .bazelrc.

2. Add to your MODULE.bazel file:

bazel_dep(name = "rules_cc", version = "0.2.28")

Using WORKSPACE:

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "rules_cc",
    sha256 = "0c51346fe5e7d2ee0b64a66623df0753bbb365877e6f85b8590e8de70448633e",
    strip_prefix = "rules_cc-0.2.28",
    url = "https://github.com/bazelbuild/rules_cc/releases/download/0.2.28/rules_cc-0.2.28.tar.gz",
)

load("@rules_cc//cc:extensions.bzl", "compatibility_proxy_repo")

compatibility_proxy_repo()

Full Changelog: bazelbuild/rules_cc@0.2.27...0.2.28

step-security/harden-runner

v2.22.4

Compare Source

What's Changed

• Fixed a Linux agent memory leak that could cause runners to run out of memory during jobs with heavy process or network activity.
• The workaround for GitHub’s DNS resolver and outbound proxy experiment on GitHub-hosted Linux runners now defaults to enabled when feature flags can’t be fetched.
• Improved HTTP/2 TLS interception on Linux (enterprise tier).
• Added retries for failed monitoring API requests, improving reliability of monitoring initialization and raw-event uploads.

Full Changelog: step-security/harden-runner@v2.22.3...v2.22.4

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 6am every weekday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.62%. Comparing base (b3d8aae) to head (e73e181).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4769   +/-   ##
=======================================
  Coverage   86.62%   86.62%           
=======================================
  Files         530      530           
  Lines       21169    21169           
=======================================
  Hits        18335    18335           
  Misses       2834     2834           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.