chore(deps): update mdgreenwald/mozilla-sops-action action to v2.1.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
mdgreenwald/mozilla-sops-action	action	minor	v2.0.0 → v2.1.0

---

Release Notes

mdgreenwald/mozilla-sops-action (mdgreenwald/mozilla-sops-action)

v2.1.0

Compare Source

Added

• New optional token input. When set, the latest-version lookup against the GitHub API sends Authorization: Bearer <token>, raising the rate limit from 60/hr (unauthenticated, per source IP) to 1000/hr. Typically ${{ secrets.GITHUB_TOKEN }}. (#​244)

Security

• Forced js-yaml to ^4.2.0 via npm overrides to fix a quadratic-complexity DoS in merge-key (<<) handling (GHSA-h67p-54hq-rp68 / CVE-2026-53550). js-yaml@3.x was present only as a dev-only transitive dependency (via ts-jest → @jest/transform → babel-plugin-istanbul → @istanbuljs/load-nyc-config); the production bundle was never affected. (#​243)

Internal

• Bumped the stableSopsVersion offline fallback to v3.13.1.

v2.0.1

Compare Source

CI/tooling hardening release. No changes to action.yml or runtime behavior.

Internal

• package.json now declares engines/devEngines pinning Node to ^24.0.0, matching the node24 action runtime.
• unit-tests, integration-tests, and prettify-code workflows now pin Node via actions/setup-node@v6 with node-version-file: package.json, instead of relying on the runner's preinstalled Node.
• unit-tests and prettify-code workflows switched to npm ci (from npm install / ad-hoc npx) for reproducible, lockfile-driven installs; prettify-code now runs npm run format-check.
• actions/checkout bumped to v6.0.3; github/codeql-action bumped to v4.
• Release workflow now extracts release notes from CHANGELOG.md instead of auto-generating them from commits.
• Dependency bumps: @types/node to ^25.9.3, @vercel/ncc to ^0.44.0, prettier to ^3.8.4, ts-jest to ^29.4.11, and transitive undici to 6.27.0.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.