Code execution via unsafe bazel mod deps

Code execution in bazel-module and bazelisk in Mend.io Renovate 43.65.0 through 43.102.10 allows attackers to run commands via malicious Bazel dependencies. During lockFileMaintenance, Renovate regenerates MODULE.bazel.lock by running the external bazel mod deps command, so attacker-controlled module code referenced during dependency resolution can execute, including ctx.execute calls named in the CVE record. Exposure requires the bazel-module or bazelisk manager with lock file maintenance enabled and, for self-hosted use, explicit opt-in to allowedUnsafeExecutions for bazelModDeps; published scoring treats exploitation as local and high-privilege rather than unauthenticated internet-reachable.