ci(tools): update endbug/add-and-commit action to v11

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
EndBug/add-and-commit	action	major	v10 → v11

---

Release Notes

EndBug/add-and-commit (EndBug/add-and-commit)

v11.1.1

Compare Source

What's Changed

• docs: highlight untrusted git-arg interpolation as a warning callout by @​EndBug in #​781
• fix: Remove GH var interpolation in action.yml docstring by @​dzcode in #​783
• fix: validate denylisted git args on every token by @​EndBug in #​784

New Contributors

• @​dzcode made their first contribution in #​783

Full Changelog: EndBug/add-and-commit@v11.1.0...v11.1.1

v11.1.0

Compare Source

What's Changed

• feat: add push_attempts to retry failed pushes by @​EndBug in #​764
• test: add integration tests for the shipped action by @​EndBug in #​766
• feat: add dry_run input by @​EndBug in #​765
• docs: add nmattia as a contributor for ideas by @​allcontributors[bot] in #​767
• docs: add jcbhmr as a contributor for ideas by @​allcontributors[bot] in #​768
• fix: reject remote-helper overrides skipped by -u by @​EndBug in #​770
• fix: block scheme:: remote helpers and restrict git transports by @​EndBug in #​771
• fix: resolve absolute cwd without dumping the minified bundle (#​495) by @​EndBug in #​772
• feat: treat pull: true as a default git pull by @​EndBug in #​773
• docs: add ross-spencer as a contributor for bug by @​allcontributors[bot] in #​774
• docs: add louisabraham as a contributor for ideas by @​allcontributors[bot] in #​775
• fix: reject --pathspec-from-file to prevent log disclosure by @​EndBug in #​777
• fix: neutralize workflow-command injection in info logs by @​EndBug in #​776
• fix: reject glued quotes that string-argv would split into extra git flags by @​EndBug in #​778
• chore(deps): bump js-yaml from 5.2.3 to 5.3.0 by @​dependabot[bot] in #​780
• chore(deps-dev): bump @​vercel/ncc from 0.44.1 to 0.45.0 by @​dependabot[bot] in #​779

Full Changelog: EndBug/add-and-commit@v11.0.0...v11.1.0

v11.0.0

Compare Source

What's Changed

• chore(deps): bump picomatch by @​dependabot[bot] in #​724
• chore(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by @​dependabot[bot] in #​725
• chore(deps): bump lodash from 4.17.23 to 4.18.1 by @​dependabot[bot] in #​728
• chore(deps-dev): bump ts-jest from 29.4.6 to 29.4.9 by @​dependabot[bot] in #​727
• chore(deps): bump @​actions/github from 9.0.0 to 9.1.0 by @​dependabot[bot] in #​729
• chore(deps): bump @​actions/github from 9.1.0 to 9.1.1 by @​dependabot[bot] in #​732
• chore(deps): bump @​actions/core from 3.0.0 to 3.0.1 by @​dependabot[bot] in #​733
• ci(deps): bump actions/dependency-review-action from 4 to 5 by @​dependabot[bot] in #​734
• chore(deps-dev): bump ts-jest from 29.4.9 to 29.4.11 by @​dependabot[bot] in #​736
• chore(deps-dev): bump jest from 30.3.0 to 30.4.2 by @​dependabot[bot] in #​735
• chore(deps-dev): bump eslint-plugin-prettier from 5.5.5 to 5.5.6 by @​dependabot[bot] in #​738
• chore(deps): bump js-yaml from 4.1.1 to 4.2.0 by @​dependabot[bot] in #​739
• ci(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​741
• chore(deps): bump undici from 6.24.1 to 6.27.0 by @​dependabot[bot] in #​744
• ci(deps): bump actions/setup-node from 6 to 7 by @​dependabot[bot] in #​749
• chore(deps-dev): bump @​vercel/ncc from 0.38.4 to 0.44.1 by @​dependabot[bot] in #​746
• chore(deps): bump js-yaml from 4.2.0 to 5.2.1 by @​dependabot[bot] in #​747
• chore(deps-dev): bump ts-jest from 29.4.11 to 29.4.12 by @​dependabot[bot] in #​750
• chore(deps): bump js-yaml from 5.2.1 to 5.2.2 by @​dependabot[bot] in #​751
• chore(deps): bump undici from 6.27.0 to 6.28.0 by @​dependabot[bot] in #​753
• fix: reject remote-helper git flags that enable RCE by @​EndBug in #​754
• fix: prevent git option injection via new_branch by @​EndBug in #​755
• fix: verify committed lib/ matches source in CI by @​EndBug in #​756
• fix: stop logging full git config (credential leak) by @​EndBug in #​758
• fix: reject -F/--file git args that can exfiltrate runner files by @​EndBug in #​759
• fix: reject unmatched quotes in matchGitArgs to prevent flag injection by @​EndBug in #​760
• fix: refuse unexpected gitlinks staged by git add by @​EndBug in #​761
• fix: do not report committed=true for empty commit SHA by @​EndBug in #​757
• ci: pin actions-tagger and restrict release workflow permissions by @​EndBug in #​762
• fix: neutralize bidi and control chars in action logs by @​EndBug in #​763

Full Changelog: EndBug/add-and-commit@v10.0.0...v11.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.