chore(deps): bump codecov/codecov-action from 5.5.4 to 6.0.0

Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5.5.4 to 6.0.0.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](75cd11691c...57e3a136b7)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependabot.yml

@@ -4,6 +4,8 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 2
     labels:
       - "kind/dependencies"
       - "bot"
@@ -11,6 +13,8 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 2
     versioning-strategy: "increase"
     allow:
       - dependency-type: "production"

.github/upx-releases.json

@@ -1,23 +1,44 @@
 {
   "latest": {
-    "id": 274789817,
+    "id": 293545149,
-    "tag_name": "v5.1.0",
+    "tag_name": "v5.1.1",
-    "html_url": "https://github.com/upx/upx/releases/tag/v5.1.0",
+    "html_url": "https://github.com/upx/upx/releases/tag/v5.1.1",
     "assets": [
-      "https://github.com/upx/upx/releases/download/v5.1.0/upx-5.1.0-amd64_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-amd64_linux.tar.xz",
-      "https://github.com/upx/upx/releases/download/v5.1.0/upx-5.1.0-arm64_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-arm64_linux.tar.xz",
-      "https://github.com/upx/upx/releases/download/v5.1.0/upx-5.1.0-arm_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-arm_linux.tar.xz",
-      "https://github.com/upx/upx/releases/download/v5.1.0/upx-5.1.0-armeb_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-armeb_linux.tar.xz",
-      "https://github.com/upx/upx/releases/download/v5.1.0/upx-5.1.0-dos.zip",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-dos.zip",
-      "https://github.com/upx/upx/releases/download/v5.1.0/upx-5.1.0-i386_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-i386_linux.tar.xz",
-      "https://github.com/upx/upx/releases/download/v5.1.0/upx-5.1.0-mips_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-mips_linux.tar.xz",
-      "https://github.com/upx/upx/releases/download/v5.1.0/upx-5.1.0-mipsel_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-mipsel_linux.tar.xz",
-      "https://github.com/upx/upx/releases/download/v5.1.0/upx-5.1.0-powerpc64le_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-powerpc64le_linux.tar.xz",
-      "https://github.com/upx/upx/releases/download/v5.1.0/upx-5.1.0-powerpc_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-powerpc_linux.tar.xz",
-      "https://github.com/upx/upx/releases/download/v5.1.0/upx-5.1.0-riscv64_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-riscv64_linux.tar.xz",
-      "https://github.com/upx/upx/releases/download/v5.1.0/upx-5.1.0-src.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-src.tar.xz",
-      "https://github.com/upx/upx/releases/download/v5.1.0/upx-5.1.0-win32.zip",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-win32.zip",
-      "https://github.com/upx/upx/releases/download/v5.1.0/upx-5.1.0-win64.zip"
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-win64.zip"
+    ]
+  },
+  "v5.1.1": {
+    "id": 293545149,
+    "tag_name": "v5.1.1",
+    "html_url": "https://github.com/upx/upx/releases/tag/v5.1.1",
+    "assets": [
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-amd64_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-arm64_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-arm_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-armeb_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-dos.zip",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-i386_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-mips_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-mipsel_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-powerpc64le_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-powerpc_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-riscv64_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-src.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-win32.zip",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-win64.zip"
     ]
   },
   "v5.1.0": {
@@ -281,6 +302,27 @@
       "https://github.com/upx/upx/releases/download/v4.0.0/upx-4.0.0-win64.zip"
     ]
   },
+  "edge": {
+    "id": 293545149,
+    "tag_name": "v5.1.1",
+    "html_url": "https://github.com/upx/upx/releases/tag/v5.1.1",
+    "assets": [
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-amd64_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-arm64_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-arm_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-armeb_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-dos.zip",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-i386_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-mips_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-mipsel_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-powerpc64le_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-powerpc_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-riscv64_linux.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-src.tar.xz",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-win32.zip",
+      "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-win64.zip"
+    ]
+  },
   "v3.99": {
     "id": 81217748,
     "tag_name": "v3.99",

.github/workflows/ci.yml

@@ -4,7 +4,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
 permissions:
   contents: read
 
@@ -18,8 +17,6 @@ on:
     tags:
       - 'v*'
   pull_request:
-    paths-ignore:
-      - '.github/upx-releases.json'
 
 jobs:
   ci:
@@ -36,7 +33,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Download files
         shell: bash
@@ -73,7 +70,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: UPX
         uses: ./

.github/workflows/labels.yml

@@ -4,7 +4,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
 permissions:
   contents: read
 
@@ -24,16 +23,14 @@ jobs:
   labeler:
     runs-on: ubuntu-latest
     permissions:
-      # same as global permissions
+      contents: read # same as global permissions
-      contents: read
+      issues: write # required to update labels
-      # required to update labels
-      issues: write
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Run Labeler
-        uses: crazy-max/ghaction-github-labeler@v5
+        uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d # v6.0.0
         with:
           dry-run: ${{ github.event_name == 'pull_request' }}

.github/workflows/test.yml

@@ -4,7 +4,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
 permissions:
   contents: read
 
@@ -14,8 +13,6 @@ on:
       - 'master'
       - 'releases/v*'
   pull_request:
-    paths-ignore:
-      - '.github/upx-releases.json'
 
 jobs:
   test:
@@ -23,16 +20,16 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Test
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
         with:
           source: .
           targets: test
       -
         name: Upload coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
         with:
           files: ./coverage/clover.xml
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/upx-releases-json.yml

@@ -4,7 +4,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
 permissions:
   contents: read
 
@@ -16,23 +15,19 @@ on:
     branches:
       - 'master'
   pull_request:
-    paths-ignore:
-      - '.github/upx-releases.json'
 
 jobs:
   generate:
-    uses: crazy-max/.github/.github/workflows/releases-json.yml@fa6141aedf23596fb8bdcceab9cce8dadaa31bd9
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@bb328ea508cd6a89d0865555ddbeb148e5724aed # v1.3.0
     with:
       repository: upx/upx
       artifact_name: upx-releases-json
       filename: upx-releases.json
-    secrets: inherit
 
   open-pr:
     runs-on: ubuntu-22.04
     if: github.event_name != 'pull_request'
     permissions:
-      # required to create PR
       contents: write
       pull-requests: write
     needs:
@@ -40,10 +35,10 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Download
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: upx-releases-json
           path: .github
@@ -53,7 +48,7 @@ jobs:
           git add -A .
       -
         name: Create PR
-        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
         with:
           base: master
           branch: bot/upx-releases-json

.github/workflows/validate.yml

@@ -4,7 +4,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
 permissions:
   contents: read
 
@@ -21,15 +20,15 @@ jobs:
   prepare:
     runs-on: ubuntu-latest
     outputs:
-      targets: ${{ steps.generate.outputs.targets }}
+      matrix: ${{ steps.generate.outputs.matrix }}
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
-        name: List targets
+        name: Generate matrix
         id: generate
-        uses: docker/bake-action/subaction/list-targets@v6
+        uses: docker/bake-action/subaction/matrix@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
         with:
           target: validate
 
@@ -40,10 +39,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: ${{ fromJson(needs.prepare.outputs.targets) }}
+        include: ${{ fromJson(needs.prepare.outputs.matrix) }}
     steps:
       -
         name: Validate
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
         with:
           targets: ${{ matrix.target }}

.github/workflows/zizmor.yml

@@ -0,0 +1,27 @@
+name: zizmor
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - 'master'
+      - 'releases/v*'
+  pull_request:
+
+jobs:
+  run:
+    uses: crazy-max/.github/.github/workflows/zizmor.yml@bbd31df64ee0f097a02f12495f541f9236f18c46 # v1.2.0
+    permissions:
+      contents: read
+      security-events: write
+    with:
+      min-severity: medium
+      min-confidence: medium
+      persona: pedantic

.github/zizmor.yml

@@ -0,0 +1,4 @@
+# https://docs.zizmor.sh/configuration/
+rules:
+  secrets-outside-env:
+    disable: true

README.md

@@ -32,12 +32,9 @@ jobs:
   upx:
     runs-on: ubuntu-latest
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
       -
         name: Run UPX
-        uses: crazy-max/ghaction-upx@v3
+        uses: crazy-max/ghaction-upx@v4
         with:
           version: latest
           files: |
@@ -57,12 +54,9 @@ jobs:
   upx:
     runs-on: ubuntu-latest
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
       -
         name: Install UPX
-        uses: crazy-max/ghaction-upx@v3
+        uses: crazy-max/ghaction-upx@v4
         with:
           install-only: true
       -