Pin dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
SonarSource/ci-github-actions	action	pinDigest	→ 5fca0c5
SonarSource/gh-action_cache	action	patch	v1.5.0 → v1.5.1
SonarSource/unified-dogfooding-actions	action	pin	v1 → 1.0.0

---

Release Notes

SonarSource/gh-action_cache (SonarSource/gh-action_cache)

v1.5.1

Compare Source

What's Changed

Improvements

• BUILD-11295 Gate cache-metrics on layered decision file (workflow env > pre-job file) by @​julien-carsique-sonarsource in #​71
  Layered gate for the pipeline-runtime-metrics emission introduced in v1.5.0. Workflow env.CI_METRICS_ENABLED still wins ('true'/'false'); when unset, the action now honours ${CI_METRICS_DIR}/enabled — a presence-only decision file written at job start by the runner pre-job hook (in github-runners-infra) based on per-env, per-repo, per-workflow allow/deny lists. No workflow change needed to opt in.

Security & maintenance

• BUILD-11297 Clear 14 high/medium SCA risks via npm overrides by @​julien-carsique-sonarsource in #​70
  Cleared 14 high/medium open dependency risks (1 critical and 1 low cleared as a bonus) by pinning transitive deps via npm overrides in package.json: fast-xml-parser 5.3.4→5.8.0, undici 5.29.0→6.25.0, vite 7.3.1→7.3.3, rollup 4.57.1→4.60.4, postcss 8.5.6→8.5.15, picomatch 4.0.3→4.0.4. No user-facing API change.

Full Changelog: SonarSource/gh-action_cache@v1.5.0...v1.5.1

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • "after 7am every weekday,before 8pm every weekday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined

Post-upgrade command 'pre-commit autoupdate --freeze || true' has not been added to the allowed list in allowedCommands

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: BUILD-11443

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud