Skip to content

build(deps): bump the github-actions group with 9 updates - #34

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-4c64c041de
Closed

build(deps): bump the github-actions group with 9 updates#34
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-4c64c041de

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 9 updates:

Package From To
actions/checkout 4 7
github/codeql-action 3 4
actions/upload-artifact 4 7
azure/setup-helm 4.3.0 5.0.1
docker/login-action 65b78e6e13532edd9afa3aa52ac7964289d1a9c1 d3b9cdfa580156c018ca5e745c1bf653d8ea46b5
ossf/scorecard-action 2.4.1 2.5.0
github/codeql-action/upload-sarif 3.28.17 4.39.0
actions/setup-go 5.2.0 7.0.0
aquasecurity/trivy-action 97e0b3872f55f89b95b2f65b3dbab56962816478 6abccf398f78b4c337599c0656f933d91efb91a0

Updates actions/checkout from 4 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Commits

Updates github/codeql-action from 3 to 4

Release notes

Sourced from github/codeql-action's releases.

v3.39.0

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

v3.38.3

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

v3.38.2

  • Update default CodeQL bundle version to 2.27.1. #4160

v3.38.1

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v3.38.0

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

v3.37.9

  • Update default CodeQL bundle version to 2.26.4. #4106

v3.37.8

No user facing changes.

v3.37.7

  • Update default CodeQL bundle version to 2.26.3. #4085

v3.37.6

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v3.37.5

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

v3.37.4

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051

v3.37.3

No user facing changes.

v3.37.2

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

v3.37.1

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

4.38.2 - 24 Sept 2026

  • Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

Commits
  • 1580058 Add unit test for sendSuccessStatusReport
  • 6aee1f8 Sort registry_types in status report
  • a7700b5 Merge branch 'main' into mario-campos/automate-changenotes-assemble
  • 43db2c0 Include proxy version in telemetry
  • 6308e36 Return release version from getProxyBinaryPath
  • aa80ca0 Move start-proxy status report handling into its own file
  • See full diff in compare view

Updates actions/upload-artifact from 4 to 7

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

... (truncated)

Commits
  • cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
  • c2acded chore: prepare v7.0.2 release
  • 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
  • 8cbe1be Bump @​actions/artifact to 6.3.1
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • Additional commits viewable in compare view

Updates azure/setup-helm from 4.3.0 to 5.0.1

Release notes

Sourced from azure/setup-helm's releases.

v5.0.1

Fixed

Changed

v5.0.0

Changed

v4.3.1

Changed

... (truncated)

Changelog

Sourced from azure/setup-helm's changelog.

[5.0.1] - 2026-06-23

Fixed

Changed

[5.0.0] - 2026-03-23

Changed

... (truncated)

Commits
  • 9bc31f4 build
  • 95ecf49 Bump version to 5.0.1 and update CHANGELOG with recent changes (#287)
  • 4180b1c Bump the actions group with 2 updates (#285)
  • 6949b7f Bump undici (#284)
  • 51ce767 Bump actions/checkout in /.github/workflows in the actions group (#286)
  • d6da4f4 Bump the actions group with 5 updates (#283)
  • 7e2bc10 Bump actions/checkout in /.github/workflows in the actions group (#280)
  • 64d6be9 Bump the actions group with 2 updates (#279)
  • 69214f9 fix: use chmod 755 instead of 777 for downloaded helm binary and folder (#278)
  • 9dad99f Bump vitest from 4.1.7 to 4.1.8 in the actions group (#277)
  • Additional commits viewable in compare view

Updates docker/login-action from 65b78e6e13532edd9afa3aa52ac7964289d1a9c1 to d3b9cdfa580156c018ca5e745c1bf653d8ea46b5

Commits
  • d3b9cdf Merge pull request #1089 from crazy-max/fix-registry-auth-ecr-false
  • a27b71b chore: update generated content
  • 2c873c3 test: simplify registry-auth ECR regression coverage
  • b4bb2a4 keep registry-auth ecr: false instead of falling back to auto
  • 783ae9c Merge pull request #1064 from docker/dependabot/github_actions/codeql-actions...
  • b1725c2 build(deps): bump the codeql-actions group across 1 directory with 2 updates
  • 0a596b2 Merge pull request #1073 from quentin-laplanche-docker/ci/remove-docker-notation
  • 5d1ee94 ci: replace registry container action reference
  • af63523 Merge pull request #1061 from docker/dockerhub-oidc-logs
  • 72edfa6 chore: update generated content
  • Additional commits viewable in compare view

Updates ossf/scorecard-action from 2.4.1 to 2.5.0

Release notes

Sourced from ossf/scorecard-action's releases.

v2.5.0

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the Scorecard v5.6.0 release notes.

Other

New Contributors

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

v2.4.4

What's Changed

This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the Scorecard v5.4.0 release notes and the Scorecard v5.5.0 release notes.

Full Changelog: ossf/scorecard-action@v2.4.3...v2.4.4

v2.4.3

What's Changed

This update bumps the Scorecard version to the v5.3.0 release. For a complete list of changes, please refer to the Scorecard v5.3.0 release notes.

Documentation

... (truncated)

Commits
  • fa7117d Bump action tag for v2.5.0 release (#1720)
  • cef4eb5 🌱 Bump Scorecard to v5.6.0 (#1719)
  • bedb16e ✨ Add intoto results format (#1702)
  • de70347 Remove the leftover debug print of the auth token (#1709)
  • 950873d 🌱 Derive the reported Scorecard version from go.mod (#1718)
  • 2ce8ee4 🌱 Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (#1695)
  • aabdf5a 🌱 Bump the github-actions group across 1 directory with 7 updates (#...
  • b4b9adf 🌱 CodeQL: Analyze workflows instead of a placeholder JavaScript file
  • 4e9f2a2 📖 RELEASE.md: Document drafting release notes
  • f618e8b 🌱 Build the image with Go 1.27.2 and refresh distroless
  • Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 3.28.17 to 4.39.0

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.39.0

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

v4.38.3

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

v4.38.2

  • Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

  • Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

v4.37.7

  • Update default CodeQL bundle version to 2.26.3. #4085

v4.37.6

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

v4.37.4

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051

v4.37.3

No user facing changes.

v4.37.2

  • The new address format for the config-file input that was introduced in Cod...

    Description has been truncated

@dependabot
build(deps): bump the github-actions group with 9 updates
10dd2a9 
Bumps the github-actions group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `7` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3` | `4` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` |
| [azure/setup-helm](https://github.com/azure/setup-helm) | `4.3.0` | `5.0.1` |
| [docker/login-action](https://github.com/docker/login-action) | `65b78e6e13532edd9afa3aa52ac7964289d1a9c1` | `d3b9cdfa580156c018ca5e745c1bf653d8ea46b5` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.1` | `2.5.0` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `3.28.17` | `4.39.0` |
| [actions/setup-go](https://github.com/actions/setup-go) | `5.2.0` | `7.0.0` |
| [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) | `97e0b3872f55f89b95b2f65b3dbab56962816478` | `6abccf398f78b4c337599c0656f933d91efb91a0` |


Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v4...v7)

Updates `github/codeql-action` from 3 to 4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v3...v4)

Updates `actions/upload-artifact` from 4 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v7)

Updates `azure/setup-helm` from 4.3.0 to 5.0.1
- [Release notes](https://github.com/azure/setup-helm/releases)
- [Changelog](https://github.com/Azure/setup-helm/blob/main/CHANGELOG.md)
- [Commits](Azure/setup-helm@v4.3.0...v5.0.1)

Updates `docker/login-action` from 65b78e6e13532edd9afa3aa52ac7964289d1a9c1 to d3b9cdfa580156c018ca5e745c1bf653d8ea46b5
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@65b78e6...d3b9cdf)

Updates `ossf/scorecard-action` from 2.4.1 to 2.5.0
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@f49aabe...fa7117d)

Updates `github/codeql-action/upload-sarif` from 3.28.17 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@60168ef...6f2ac81)

Updates `actions/setup-go` from 5.2.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@3041bf5...b7ad1da)

Updates `aquasecurity/trivy-action` from 97e0b3872f55f89b95b2f65b3dbab56962816478 to 6abccf398f78b4c337599c0656f933d91efb91a0
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](aquasecurity/trivy-action@97e0b38...6abccf3)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/codeql-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: azure/setup-helm
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: docker/login-action
  dependency-version: d3b9cdfa580156c018ca5e745c1bf653d8ea46b5
  dependency-type: direct:production
  dependency-group: github-actions
- dependency-name: ossf/scorecard-action
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.39.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-go
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: aquasecurity/trivy-action
  dependency-version: 6abccf398f78b4c337599c0656f933d91efb91a0
  dependency-type: direct:production
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested review from pfl and tkatila as code owners October 20, 2026 07:45
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 20, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 25, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 25, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/github-actions-4c64c041de branch October 25, 2026 18:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pfl pfl Awaiting requested review from pfl pfl is a code owner
@tkatila tkatila Awaiting requested review from tkatila tkatila is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants