Bump the all-dependencies group with 10 updates by dependabot[bot] · Pull Request #418 · Contrast-Security-OSS/integration-verify-github-action

dependabot · 2026-10-23T14:57:14Z

Bumps the all-dependencies group with 10 updates:

Package	From	To
step-security/harden-runner	`2.19.1`	`2.22.2`
actions/checkout	`6.0.2`	`7.0.1`
step-security/setup-qemu-action	`4.0.0`	`4.4.0`
step-security/setup-buildx-action	`4.0.0`	`4.4.1`
step-security/docker-login-action	`4.1.0`	`4.6.0`
docker/metadata-action	`5.10.0`	`6.2.0`
step-security/docker-build-push-action	`7.1.0`	`7.4.0`
actions/setup-python	`6.2.0`	`7.0.0`
actions/cache	`5.0.2`	`6.1.0`
actions/upload-artifact	`6.0.0`	`7.0.2`

Updates step-security/harden-runner from 2.19.1 to 2.22.2

Release notes

Sourced from step-security/harden-runner's releases.

v2.22.2

What's Changed

Fixed inbound (ingress) network traffic being incorrectly classified as outbound (egress) traffic on macOS

Fixed implicit endpoints intended for self-hosted runners being applied to custom VM environments on Linux (enterprise tier)

Improved network and DNS tracing, enforcement logic, and process information correlation on Linux (enterprise tier)

Full Changelog: step-security/harden-runner@v2.22.1...v2.22.2

v2.22.1

What's Changed

Fixed security rules not initializing on GHES self-hosted runners

Fixed GHES connectivity in block mode by implicitly allowing the GHES hostname

Full Changelog: step-security/harden-runner@v2.22.0...v2.22.1

v2.22.0

What's Changed

Linux ARM64 support for community tier

GHES support for self-hosted VMs (enterprise tier)

MacOS and Windows runner deny list support for block policy (enterprise tier).

Full Changelog: step-security/harden-runner@v2.21.1...v2.22.0

v2.21.1

What's Changed

Improved performance of the disable-sudo feature.

Fixed an issue in the Community tier where new endpoints required by the GitHub Actions runner were not being implicitly allowed in block mode.

Fixed the Harden-Runner post step failing on Linux distributions that do not have a merged /usr filesystem layout (for example Debian 11), where /usr/bin/echo does not exist. This mainly affected self-hosted runners.

Documentation updates: clarified which features are in the Community (free) vs Enterprise tier.

Full Changelog: step-security/harden-runner@v2.21.0...v2.21.1

v2.21.0

What's Changed

Support for denied endpoints in block mode. This is included in the enterprise tier. Customers can deny outbound calls, for example, to public package registries.

Improved Support for AWS CodeBuild GitHub Actions Runners.

Bug fixes.

Full Changelog: step-security/harden-runner@v2.20.1...v2.21.0

v2.20.1

What's Changed

AWS CodeBuild-hosted runner support

Implicitly allow single-labeled (internal) domains in block-mode

Full Changelog: step-security/harden-runner@v2.20.0...v2.20.1

... (truncated)

Commits

dc2769a Merge pull request #707 from step-security/rc-45
ab0b273 Merge pull request #706 from h0x0er/rc-45
03ccff8 Remove agent-preinstalled skip for third-party runners
815e48d Skip agent install and post-step cleanup when agent is already installed
ccd8616 Merge pull request #704 from h0x0er/jatin/ghes-endp
037ccfd implicitly add ghes endpoint in allowList
e7438c7 Merge pull request #703 from h0x0er/jatin/ghes-codebuild-fixes
afb0b33 fixes for armour rules not getting initialised
351661c Merge pull request #701 from step-security/rc-44
1dc7f2e Merge pull request #702 from h0x0er/jatin/ghes-changes-up
Additional commits viewable in compare view

Updates actions/checkout from 6.0.2 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464

update error wording by @aiqiaoy in actions/checkout#2467

New Contributors

@aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

[BREAKING] backport allow-unsafe-pr-checkout to v6 by @aiqiaoy in actions/checkout#2500

backport fixes to releases-v6 by @aiqiaoy in actions/checkout#2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

Update changelog by @ericsciple in actions/checkout#2357

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

Update changelog for v6.0.3 by @yaananth in actions/checkout#2446

New Contributors

@yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

Skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

Trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

Escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

v7.0.0

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Various dependency updates

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

... (truncated)

Commits

3d3c42e prep v7.0.1 release (#2531)
2880268 escape values passed to --unset (#2530)
12cd223 trim only ascii whitespace for branch (#2521)
62661c4 skip running unsafe pr check if input is default (#2518)
e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
631c942 eslint 9 (#2474)
4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
ba09753 Bump actions/checkout from 6 to 7 (#2488)
b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
Additional commits viewable in compare view

Updates step-security/setup-qemu-action from 4.0.0 to 4.4.0

Release notes

Sourced from step-security/setup-qemu-action's releases.

v4.4.0

What's Changed

fix: Security updates by @github-actions[bot] in step-security/setup-qemu-action#58

chore: Cherry-pick changes from upstream by @anurag-stepsecurity in step-security/setup-qemu-action#59

build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in step-security/setup-qemu-action#4

build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.4 by @dependabot[bot] in step-security/setup-qemu-action#5

build(deps): bump actions/checkout from 4.3.1 to 7.0.1 by @dependabot[bot] in step-security/setup-qemu-action#16

build(deps): bump step-security/harden-runner from 2.14.0 to 2.21.1 by @dependabot[bot] in step-security/setup-qemu-action#18

fix: resolve security vulnerabilities by @anurag-stepsecurity in step-security/setup-qemu-action#60

New Contributors

@anurag-stepsecurity made their first contribution in step-security/setup-qemu-action#59

Full Changelog: step-security/setup-qemu-action@v4.2.0...v4.4.0

v4.2.0

What's Changed

chore: Cherry-picked changes from upstream by @github-actions[bot] in step-security/setup-qemu-action#50

build(deps): bump axios from 1.16.0 to 1.18.0 by @dependabot[bot] in step-security/setup-qemu-action#51

build(deps): bump js-yaml from 4.2.0 to 4.3.0 by @dependabot[bot] in step-security/setup-qemu-action#53

build(deps): bump fast-xml-parser from 5.9.3 to 5.10.1 by @dependabot[bot] in step-security/setup-qemu-action#52

build(deps): bump tar from 7.5.16 to 7.5.22 by @dependabot[bot] in step-security/setup-qemu-action#54

build(deps): bump postcss from 8.5.15 to 8.5.23 by @dependabot[bot] in step-security/setup-qemu-action#55

fix: Security updates by @github-actions[bot] in step-security/setup-qemu-action#56

fix: brace-expansion fixed by @Raj-StepSecurity in step-security/setup-qemu-action#57

Full Changelog: step-security/setup-qemu-action@v4...v4.2.0

v4.1.0

What's Changed

chore: Cherry-picked changes from upstream by @github-actions[bot] in step-security/setup-qemu-action#35

fix: Security updates by @github-actions[bot] in step-security/setup-qemu-action#37

build(deps): bump axios from 1.15.0 to 1.16.0 by @dependabot[bot] in step-security/setup-qemu-action#36

build(deps): bump form-data from 4.0.5 to 4.0.6 by @dependabot[bot] in step-security/setup-qemu-action#38

build(deps): bump fast-xml-builder from 1.1.4 to 1.2.0 by @dependabot[bot] in step-security/setup-qemu-action#39

build(deps): bump fast-xml-parser from 5.5.10 to 5.9.3 by @dependabot[bot] in step-security/setup-qemu-action#41

build(deps): bump vite from 8.0.8 to 8.0.16 by @dependabot[bot] in step-security/setup-qemu-action#43

build(deps): bump ip-address from 10.1.0 to 10.2.0 by @dependabot[bot] in step-security/setup-qemu-action#40

fix: Security updates by @github-actions[bot] in step-security/setup-qemu-action#47

build(deps): bump js-yaml from 4.1.1 to 4.2.0 by @dependabot[bot] in step-security/setup-qemu-action#45

build(deps): bump tar from 7.5.13 to 7.5.16 by @dependabot[bot] in step-security/setup-qemu-action#44

build(deps): bump undici from 6.24.1 to 6.27.0 by @dependabot[bot] in step-security/setup-qemu-action#46

fix: Security updates by @github-actions[bot] in step-security/setup-qemu-action#48

Full Changelog: step-security/setup-qemu-action@v4...v4.1.0

Commits

d21542a Merge pull request #60 from step-security/fix-vulns
8ca800d fix: resolve security vulnerabilities
3c5e5cf Merge pull request #18 from step-security/dependabot/github_actions/step-secu...
65d9b08 build(deps): bump step-security/harden-runner from 2.14.0 to 2.21.1
85ce361 Merge pull request #16 from step-security/dependabot/github_actions/actions/c...
feb9f40 build(deps): bump actions/checkout from 4.3.1 to 7.0.1
26f6636 Merge pull request #5 from step-security/dependabot/github_actions/ossf/score...
0b628e3 build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.4
97c5d5c Merge pull request #4 from step-security/dependabot/github_actions/actions/up...
b9f237c build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1
Additional commits viewable in compare view

Updates step-security/setup-buildx-action from 4.0.0 to 4.4.1

Release notes

Sourced from step-security/setup-buildx-action's releases.

v4.4.1

What's Changed

fix: Security updates by @github-actions[bot] in step-security/setup-buildx-action#50

build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.4 by @dependabot[bot] in step-security/setup-buildx-action#6

build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in step-security/setup-buildx-action#16

build(deps): bump actions/checkout from 4.3.1 to 7.0.1 by @dependabot[bot] in step-security/setup-buildx-action#54

chore: Cherry-pick changes from upstream by @anurag-stepsecurity in step-security/setup-buildx-action#55

build(deps): bump step-security/harden-runner from 2.14.0 to 2.21.1 by @dependabot[bot] in step-security/setup-buildx-action#53

fix: resolve security vulnerabilities by @anurag-stepsecurity in step-security/setup-buildx-action#56

Full Changelog: step-security/setup-buildx-action@v4.2.0...v4.4.1

v4.2.0

What's Changed

chore: Cherry-picked changes from upstream by @github-actions[bot] in step-security/setup-buildx-action#46

Full Changelog: step-security/setup-buildx-action@v4...v4.2.0

v4.1.0

What's Changed

fix: upgraded deps to fix vulnerabilities by @Raj-StepSecurity in step-security/setup-buildx-action#32

fix: upgrade packages to fix vulnerabilities by @Raj-StepSecurity in step-security/setup-buildx-action#33

fix: Resolve security vulnerabilities by @anurag-stepsecurity in step-security/setup-buildx-action#34

chore: Remove guarddog.yml by @anurag-stepsecurity in step-security/setup-buildx-action#35

chore: Cherry-picked changes from upstream by @github-actions[bot] in step-security/setup-buildx-action#37

build(deps): bump axios from 1.15.0 to 1.16.0 by @dependabot[bot] in step-security/setup-buildx-action#39

build(deps): bump fast-xml-builder from 1.1.4 to 1.2.0 by @dependabot[bot] in step-security/setup-buildx-action#38

build(deps): bump tmp from 0.2.5 to 0.2.7 by @dependabot[bot] in step-security/setup-buildx-action#42

build(deps): bump fast-xml-parser from 5.5.9 to 5.8.0 by @dependabot[bot] in step-security/setup-buildx-action#41

build(deps): bump postcss from 8.5.8 to 8.5.15 by @dependabot[bot] in step-security/setup-buildx-action#40

fix: Security updates by @github-actions[bot] in step-security/setup-buildx-action#44

fix: upgraded brace-exapansion to fix vulns by @Raj-StepSecurity in step-security/setup-buildx-action#43

New Contributors

@anurag-stepsecurity made their first contribution in step-security/setup-buildx-action#34

Full Changelog: step-security/setup-buildx-action@v4...v4.1.0

Commits

e50058a Merge pull request #56 from step-security/fix-vulns
05d364e fix: resolve security vulnerabilities
d365977 Merge pull request #53 from step-security/dependabot/github_actions/step-secu...
881554e build(deps): bump step-security/harden-runner from 2.14.0 to 2.21.1
1b276a8 Merge pull request #55 from step-security/auto-cherry-pick
ecb53d8 Merge branch 'main' into auto-cherry-pick
aecbaa9 Merge pull request #54 from step-security/dependabot/github_actions/actions/c...
a10b6bb chore: Cherry-pick changes from upstream
cf5ff02 build(deps): bump actions/checkout from 4.3.1 to 7.0.1
33b1f39 Merge pull request #16 from step-security/dependabot/github_actions/actions/u...
Additional commits viewable in compare view

Updates step-security/docker-login-action from 4.1.0 to 4.6.0

Release notes

Sourced from step-security/docker-login-action's releases.

v4.6.0

What's Changed

chore: Cherry-picked changes from upstream by @github-actions[bot] in step-security/docker-login-action#60

chore: Cherry-picked changes from upstream by @github-actions[bot] in step-security/docker-login-action#61

fix: upgraded packages to fix vulnerabilities by @Raj-StepSecurity in step-security/docker-login-action#62

build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.4 by @dependabot[bot] in step-security/docker-login-action#7

Full Changelog: step-security/docker-login-action@v4.5.1...v4.6.0

v4.5.1

What's Changed

build(deps): bump form-data from 4.0.5 to 4.0.6 by @dependabot[bot] in step-security/docker-login-action#44

fix: Security updates by @github-actions[bot] in step-security/docker-login-action#48

chore: Cherry-picked changes from upstream by @github-actions[bot] in step-security/docker-login-action#50

build(deps): bump axios from 1.16.0 to 1.18.0 by @dependabot[bot] in step-security/docker-login-action#51

build(deps): bump tar from 7.5.16 to 7.5.22 by @dependabot[bot] in step-security/docker-login-action#55

fix: Security updates by @github-actions[bot] in step-security/docker-login-action#56

fix: packages upgraded and vulnerabilities fixed by @Raj-StepSecurity in step-security/docker-login-action#57

Full Changelog: step-security/docker-login-action@v4...v4.5.1

v4.2.0

What's Changed

chore: Cherry-picked changes from upstream by @github-actions[bot] in step-security/docker-login-action#39

build(deps): bump axios from 1.15.0 to 1.16.0 by @dependabot[bot] in step-security/docker-login-action#40

build(deps): bump fast-xml-builder from 1.1.4 to 1.2.0 by @dependabot[bot] in step-security/docker-login-action#42

fix: upgraded packages to fix vulnerabilities by @Raj-StepSecurity in step-security/docker-login-action#43

Full Changelog: step-security/docker-login-action@v4...v4.2.0

Commits

8c7b695 Merge pull request #7 from step-security/dependabot/github_actions/ossf/score...
5dabd9e build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.4
41e3603 Merge pull request #62 from step-security/yarn-audit-fix
e414ead fix: upgraded packages to fix vulnerabilities
4231cd6 Merge pull request #61 from step-security/auto-cherry-pick
4a6d63e conflicted commits cherry-picked
cb49c92 fix: apply code build script
e0af704 fix: apply code build script
45799da harden buildx scoped config path handling
90deef5 harden buildx scoped config path handling
Additional commits viewable in compare view

Updates docker/metadata-action from 5.10.0 to 6.2.0

Release notes

Sourced from docker/metadata-action's releases.

v6.2.0

Preserve names in esbuild bundle by @crazy-max in docker/metadata-action#689

Bump @actions/core from 3.0.0 to 3.0.1 in docker/metadata-action#663

Bump @actions/github from 9.0.0 to 9.1.1 in docker/metadata-action#666

Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/metadata-action#672 docker/metadata-action#696

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/metadata-action#690

Bump @sigstore/verify from 3.1.0 to 3.1.1 in docker/metadata-action#693

Bump csv-parse from 6.2.1 to 7.0.0 in docker/metadata-action#683

Bump js-yaml from 4.1.1 to 4.3.0 in docker/metadata-action#688

Bump moment-timezone from 0.6.1 to 0.6.2 in docker/metadata-action#664

Bump semver from 7.7.4 to 7.8.5 in docker/metadata-action#665 docker/metadata-action#695

Bump sigstore from 4.1.0 to 4.1.1 in docker/metadata-action#694

Bump tmp from 0.2.5 to 0.2.7 in docker/metadata-action#673

Bump undici from 6.25.0 to 6.27.0 in docker/metadata-action#686

Bump vite from 7.3.2 to 7.3.6 in docker/metadata-action#685

Full Changelog: docker/metadata-action@v6.1.0...v6.2.0

v6.1.0

Bump @docker/actions-toolkit from 0.79.0 to 0.90.0 in docker/metadata-action#613

Bump brace-expansion from 1.1.12 to 5.0.6 in docker/metadata-action#658 docker/metadata-action#630

Bump csv-parse from 6.1.0 to 6.2.1 in docker/metadata-action#617

Bump fast-xml-parser from 5.4.2 to 5.8.0 in docker/metadata-action#620

Bump flatted from 3.3.3 to 3.4.2 in docker/metadata-action#623

Bump glob from 10.3.15 to 10.5.0 in docker/metadata-action#621

Bump handlebars from 4.7.8 to 4.7.9 in docker/metadata-action#629

Bump lodash from 4.17.23 to 4.18.1 in docker/metadata-action#639

Bump moment-timezone from 0.6.0 to 0.6.1 in docker/metadata-action#619

Bump picomatch from 4.0.3 to 4.0.4 in docker/metadata-action#626

Bump postcss from 8.5.6 to 8.5.10 in docker/metadata-action#649

Bump tar from 6.2.1 to 7.5.15 in docker/metadata-action#657

Bump undici from 6.23.0 to 6.25.0 in docker/metadata-action#614

Bump vite from 7.3.1 to 7.3.2 in docker/metadata-action#637

Full Changelog: docker/metadata-action@v6.0.0...v6.1.0

v6.0.0

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in docker/metadata-action#605

List inputs now preserve # inside values while still supporting full-line # comments by @crazy-max in docker/metadata-action#607

Switch to ESM and update config/test wiring by @crazy-max in docker/metadata-action#602

Bump lodash from 4.17.21 to 4.17.23 in docker/metadata-action#588

Bump @actions/core from 1.11.1 to 3.0.0 in docker/metadata-action#599

Bump @actions/github from 6.0.1 to 9.0.0 in docker/metadata-action#597

Bump @docker/actions-toolkit from 0.68.0 to 0.79.0 in docker/metadata-action#604

Bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 in docker/metadata-action#600

Bump semver from 7.7.3 to 7.7.4 in docker/metadata-action#603

Full Changelog: docker/metadata-action@v5.10.0...v6.0.0

Commits

dc80280 Merge pull request #696 from docker/dependabot/npm_and_yarn/docker/actions-to...
2b9fe83 [dependabot skip] chore: update generated content
8128ce3 chore(deps): Bump @docker/actions-toolkit from 0.91.0 to 0.92.0
1d1c895 Merge pull request #695 from docker/dependabot/npm_and_yarn/semver-7.8.5
7f0c2dd Merge pull request #694 from docker/dependabot/npm_and_yarn/sigstore-4.1.1
025f8c5 [dependabot skip] chore: update generated content
e98d63c chore(deps): Bump semver from 7.8.1 to 7.8.5
37d9379 chore(deps): Bump sigstore from 4.1.0 to 4.1.1
a1b8072 Merge pull request #690 from docker/dependabot/npm_and_yarn/sigstore/core-3.2.1
e0e3381 [dependabot skip] chore: update generated content
Additional commits viewable in compare view

Updates step-security/docker-build-push-action from 7.1.0 to 7.4.0

Release notes

Sourced from step-security/docker-build-push-action's releases.

v7.4.0

What's Changed

fix: Security updates by @github-actions[bot] in step-security/docker-build-push-action#53

chore: Cherry-pick changes from upstream by @anurag-stepsecurity in step-security/docker-build-push-action#54

build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.4 by @dependabot[bot] in step-security/docker-build-push-action#9

fix: resolve security vulnerabilities by @anurag-stepsecurity in step-security/docker-build-push-action#55

build(deps): bump actions/cache from 4.3.0 to 6.1.0 by @dependabot[bot] in step-security/docker-build-push-action#48

build(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in step-security/docker-build-push-action#47

build(deps): bump step-security/setup-buildx-action from 3.11.1 to 4.2.0 by @dependabot[bot] in step-security/docker-build-push-action#46

build(deps): bump github/codeql-action from 3 to 4 by @dependabot[bot] in step-security/docker-build-push-action#23

chore: remove empty pre-commit-config.yaml by @anurag-stepsecurity in step-security/docker-build-push-action#57

[StepSecurity] ci: Harden GitHub Actions by @step-security-bot in step-security/docker-build-push-action#56

New Contributors

@anurag-stepsecurity made their first contribution in step-security/docker-build-push-action#54

Full Changelog: step-security/docker-build-push-action@v7.3.0...v7.4.0

v7.3.0

What's Changed

chore: Cherry-picked changes from upstream by @github-actions[bot] in step-security/docker-build-push-action#51

Full Changelog: step-security/docker-build-push-action@v7...v7.3.0

v7.2.0

What's Changed

build(deps): bump actions/checkout from 4 to 6 by @dependabot[bot] in step-security/docker-build-push-action#8

chore: Cherry-picked changes from upstream by @github-actions[bot] in step-security/docker-build-push-action#43

fix: upgraded deps to fix vulnerabilities by @Raj-StepSecurity in step-security/docker-build-push-action#45

Full Changelog: step-security/docker-build-push-action@v7...v7.2.0

Commits

b736dc8 Merge pull request #56 from step-security-bot/chore/GHA-290806-stepsecurity-r...
5fee498 Merge branch 'main' into chore/GHA-290806-stepsecurity-remediation
e757ed9 Merge pull request

Bumps the all-dependencies group with 10 updates: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.19.1` | `2.22.2` | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.1` | | [step-security/setup-qemu-action](https://github.com/step-security/setup-qemu-action) | `4.0.0` | `4.4.0` | | [step-security/setup-buildx-action](https://github.com/step-security/setup-buildx-action) | `4.0.0` | `4.4.1` | | [step-security/docker-login-action](https://github.com/step-security/docker-login-action) | `4.1.0` | `4.6.0` | | [docker/metadata-action](https://github.com/docker/metadata-action) | `5.10.0` | `6.2.0` | | [step-security/docker-build-push-action](https://github.com/step-security/docker-build-push-action) | `7.1.0` | `7.4.0` | | [actions/setup-python](https://github.com/actions/setup-python) | `6.2.0` | `7.0.0` | | [actions/cache](https://github.com/actions/cache) | `5.0.2` | `6.1.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6.0.0` | `7.0.2` | Updates `step-security/harden-runner` from 2.19.1 to 2.22.2 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@a5ad31d...dc2769a) Updates `actions/checkout` from 6.0.2 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...3d3c42e) Updates `step-security/setup-qemu-action` from 4.0.0 to 4.4.0 - [Release notes](https://github.com/step-security/setup-qemu-action/releases) - [Commits](step-security/setup-qemu-action@109c6ed...d21542a) Updates `step-security/setup-buildx-action` from 4.0.0 to 4.4.1 - [Release notes](https://github.com/step-security/setup-buildx-action/releases) - [Commits](step-security/setup-buildx-action@f931205...e50058a) Updates `step-security/docker-login-action` from 4.1.0 to 4.6.0 - [Release notes](https://github.com/step-security/docker-login-action/releases) - [Commits](step-security/docker-login-action@870af64...8c7b695) Updates `docker/metadata-action` from 5.10.0 to 6.2.0 - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](docker/metadata-action@c299e40...dc80280) Updates `step-security/docker-build-push-action` from 7.1.0 to 7.4.0 - [Release notes](https://github.com/step-security/docker-build-push-action/releases) - [Commits](step-security/docker-build-push-action@846549b...b736dc8) Updates `actions/setup-python` from 6.2.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a309ff8...5fda3b9) Updates `actions/cache` from 5.0.2 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@8b402f5...55cc834) Updates `actions/upload-artifact` from 6.0.0 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@b7c566a...cf430e0) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.22.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-dependencies - dependency-name: step-security/setup-qemu-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: step-security/setup-buildx-action dependency-version: 4.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: step-security/docker-login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: docker/metadata-action dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-dependencies - dependency-name: step-security/docker-build-push-action dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-dependencies - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-dependencies - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 23, 2026

andersonshatch force-pushed the dependabot/github_actions/all-dependencies-61c3440ecb branch from 519a49a to dda3674 Compare October 23, 2026 15:12

andersonshatch approved these changes Oct 23, 2026

View reviewed changes

andersonshatch merged commit af6106a into main Oct 23, 2026
3 checks passed

andersonshatch deleted the dependabot/github_actions/all-dependencies-61c3440ecb branch October 23, 2026 15:13

Navigation Menu

Repository navigation

Bump the all-dependencies group with 10 updates - #418

Bump the all-dependencies group with 10 updates#418
andersonshatch merged 1 commit into
mainfrom
dependabot/github_actions/all-dependencies-61c3440ecb

dependabot Bot commented on behalf of github Oct 23, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 23, 2026

v2.22.2

What's Changed

v2.22.1

What's Changed

v2.22.0

What's Changed

v2.21.1

What's Changed

v2.21.0

What's Changed

v2.20.1

What's Changed

v7.0.1

What's Changed

v7.0.0

What's Changed

New Contributors

v6.1.0

What's Changed

v6.0.3

What's Changed

New Contributors

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.4.0

What's Changed

New Contributors

v4.2.0

What's Changed

v4.1.0

What's Changed

v4.4.1

What's Changed

v4.2.0

What's Changed

v4.1.0

What's Changed

New Contributors

v4.6.0

What's Changed

v4.5.1

What's Changed

v4.2.0

What's Changed

v6.2.0

v6.1.0

v6.0.0

v7.4.0

What's Changed

New Contributors

v7.3.0

What's Changed

v7.2.0

What's Changed

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant