[cherry-pick] chore(deps): bump the actions group across 1 directory with 6 updates #7836

nginx-bot · 2025-05-26T09:17:17Z

Bumps the actions group with 6 updates in the / directory:

Package	From	To
docker/build-push-action	`6.16.0`	`6.17.0`
codecov/codecov-action	`5.4.2`	`5.4.3`
github/codeql-action	`3.28.17`	`3.28.18`
DavidAnson/markdownlint-cli2-action	`19.1.0`	`20.0.0`
aws-actions/configure-aws-credentials	`4.2.0`	`4.2.1`
anchore/sbom-action	`0.19.0`	`0.20.0`

Updates docker/build-push-action from 6.16.0 to 6.17.0

Release notes

Sourced from docker/build-push-action's releases.

v6.17.0

Bump @docker/actions-toolkit from 0.59.0 to 0.61.0 by @crazy-max in docker/build-push-action#1364

[!NOTE] Build record is now exported using the buildx history export command instead of the legacy export-build tool.

Full Changelog: docker/build-push-action@v6.16.0...v6.17.0

Commits

1dc7386 Merge pull request #1364 from crazy-max/history-export-cmd
9c9803f chore: update generated content
db1f6c4 DOCKER_BUILD_EXPORT_LEGACY env var to opt-in for legacy export
721e8c7 Bump @docker/actions-toolkit from 0.59.0 to 0.61.0
See full diff in compare view

Updates codecov/codecov-action from 5.4.2 to 5.4.3

Release notes

Sourced from codecov/codecov-action's releases.

v5.4.3

What's Changed

fix: OIDC on forks by @joseph-sentry in codecov/codecov-action#1823

build(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by @dependabot in codecov/codecov-action#1822

chore(release): 5.4.3 by @thomasrockhu-codecov in codecov/codecov-action#1827

Full Changelog: codecov/codecov-action@v5.4.2...v5.4.3

Changelog

Sourced from codecov/codecov-action's changelog.

v5.4.3

What's Changed

build(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by @app/dependabot in codecov/codecov-action#1822

fix: OIDC on forks by @joseph-sentry in codecov/codecov-action#1823

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3

v5.4.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.1..v5.4.2

v5.4.1

What's Changed

fix: use the github core methods by @thomasrockhu-codecov in codecov/codecov-action#1807

build(deps): bump github/codeql-action from 3.28.12 to 3.28.13 by @app/dependabot in codecov/codecov-action#1803

build(deps): bump github/codeql-action from 3.28.11 to 3.28.12 by @app/dependabot in codecov/codecov-action#1797

build(deps): bump actions/upload-artifact from 4.6.1 to 4.6.2 by @app/dependabot in codecov/codecov-action#1798

chore(release): wrapper -0.2.1 by @app/codecov-releaser-app in codecov/codecov-action#1788

build(deps): bump github/codeql-action from 3.28.10 to 3.28.11 by @app/dependabot in codecov/codecov-action#1786

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.0..v5.4.1

v5.4.0

What's Changed

update wrapper submodule to 0.2.0, add recurse_submodules arg by @matt-codecov in codecov/codecov-action#1780

build(deps): bump actions/upload-artifact from 4.6.0 to 4.6.1 by @app/dependabot in codecov/codecov-action#1775

build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.1 by @app/dependabot in codecov/codecov-action#1776

build(deps): bump github/codeql-action from 3.28.9 to 3.28.10 by @app/dependabot in codecov/codecov-action#1777

Clarify in README that use_pypi bypasses integrity checks too by @webknjaz in codecov/codecov-action#1773

Fix use of safe.directory inside containers by @Flamefire in codecov/codecov-action#1768

Fix description for report_type input by @craigscott-crascit in codecov/codecov-action#1770

build(deps): bump github/codeql-action from 3.28.8 to 3.28.9 by @app/dependabot in codecov/codecov-action#1765

Fix a typo in the example by @miranska in codecov/codecov-action#1758

build(deps): bump github/codeql-action from 3.28.5 to 3.28.8 by @app/dependabot in codecov/codecov-action#1757

build(deps): bump github/codeql-action from 3.28.1 to 3.28.5 by @app/dependabot in codecov/codecov-action#1753

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.3.1..v5.4.0

... (truncated)

Commits

18283e0 chore(release): 5.4.3 (#1827)
525fcbf build(deps): bump github/codeql-action from 3.28.13 to 3.28.17 (#1822)
b203f00 fix: OIDC on forks (#1823)
See full diff in compare view

Updates github/codeql-action from 3.28.17 to 3.28.18

Release notes

Sourced from github/codeql-action's releases.

v3.28.18

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.18 - 16 May 2025

Update default CodeQL bundle version to 2.21.3. #2893

Skip validating SARIF produced by CodeQL for improved performance. #2894

The number of threads and amount of RAM used by CodeQL can now be set via the CODEQL_THREADS and CODEQL_RAM runner environment variables. If set, these environment variables override the threads and ram inputs respectively. #2891

See the full CHANGELOG.md for more information.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

3.28.18 - 16 May 2025

Update default CodeQL bundle version to 2.21.3. #2893

Skip validating SARIF produced by CodeQL for improved performance. #2894

The number of threads and amount of RAM used by CodeQL can now be set via the CODEQL_THREADS and CODEQL_RAM runner environment variables. If set, these environment variables override the threads and ram inputs respectively. #2891

3.28.17 - 02 May 2025

Update default CodeQL bundle version to 2.21.2. #2872

3.28.16 - 23 Apr 2025

Update default CodeQL bundle version to 2.21.1. #2863

3.28.15 - 07 Apr 2025

Fix bug where the action would fail if it tried to produce a debug artifact with more than 65535 files. #2842

3.28.14 - 07 Apr 2025

Update default CodeQL bundle version to 2.21.0. #2838

3.28.13 - 24 Mar 2025

No user facing changes.

3.28.12 - 19 Mar 2025

Dependency caching should now cache more dependencies for Java build-mode: none extractions. This should speed up workflows and avoid inconsistent alerts in some cases.

Update default CodeQL bundle version to 2.20.7. #2810

3.28.11 - 07 Mar 2025

Update default CodeQL bundle version to 2.20.6. #2793

3.28.10 - 21 Feb 2025

Update default CodeQL bundle version to 2.20.5. #2772

Address an issue where the CodeQL Bundle would occasionally fail to decompress on macOS. #2768

3.28.9 - 07 Feb 2025

... (truncated)

Commits

ff0a06e Merge pull request #2896 from github/update-v3.28.18-b86edfc27
a41e084 Update changelog for v3.28.18
b86edfc Merge pull request #2893 from github/update-bundle/codeql-bundle-v2.21.3
e93b900 Merge branch 'main' into update-bundle/codeql-bundle-v2.21.3
510dfa3 Merge pull request #2894 from github/henrymercer/skip-validating-codeql-sarif
492d783 Merge branch 'main' into henrymercer/skip-validating-codeql-sarif
83bdf3b Merge pull request #2859 from github/update-supported-enterprise-server-versions
cffc916 Merge pull request #2891 from austinpray-mixpanel/patch-1
4420887 Add deprecation warning for CodeQL 2.16.5 and earlier
4e178c5 Update supported versions table in README
Additional commits viewable in compare view

Updates DavidAnson/markdownlint-cli2-action from 19.1.0 to 20.0.0

Commits

992badc Update to version 20.0.0.
fafa44c Update dependency: markdownlint-cli2 to 0.18.1.
052b336 Bump eslint-plugin-n from 17.17.0 to 17.18.0
e0b0869 Bump eslint-plugin-unicorn from 59.0.0 to 59.0.1
96cc313 Bump @eslint/js from 9.25.1 to 9.26.0
66095aa Bump eslint from 9.25.1 to 9.26.0
51af1d1 Bump eslint-plugin-unicorn from 58.0.0 to 59.0.0
81f6304 Bump @eslint/js from 9.25.0 to 9.25.1
e2c95fb Bump eslint from 9.25.0 to 9.25.1
9f58cc3 Bump @eslint/js from 9.24.0 to 9.25.0
Additional commits viewable in compare view

Updates aws-actions/configure-aws-credentials from 4.2.0 to 4.2.1

Release notes

Sourced from aws-actions/configure-aws-credentials's releases.

v4.2.1

4.2.1 (2025-05-14)

Bug Fixes

ensure explicit inputs take precedence over environment variables (e56e6c4)

prioritize explicit inputs over environment variables (df9c8fe)

Changelog

Sourced from aws-actions/configure-aws-credentials's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

4.2.1 (2025-05-14)

Bug Fixes

ensure explicit inputs take precedence over environment variables (e56e6c4)

prioritize explicit inputs over environment variables (df9c8fe)

4.2.0 (2025-05-06)

Features

add Expiration field to Outputs (a4f3267)

Document role-duration-seconds range (5a0cf01)

support action inputs as environment variables (#1338) (2c168ad)

Bug Fixes

make sure action builds, also fix dependabot autoapprove (c401b8a)

role chaning on mulitple runs (#1340) (9e38641)

4.1.0 (2025-02-08)

Features

idempotent fetch (#1289) (eb70354)

Bug Fixes

build failure due to tests (#1283) (134d71e)

Dependabot autoapprove (#1284) (b9ee51d)

Dependabot autoapprove id-token write permission (#1285) (f0af89b)

typo (#1281) (39fd91c)

4.0.3 (2025-01-27)

Features

added release-please action config (0f88004)

... (truncated)

Commits

b475783 chore(main): release 4.2.1 (#1356)
e56e6c4 Merge pull request #1355 from hozzer/main
c0573b2 update dist
df9c8fe fix: prioritize explicit inputs over environment variables
e7aeb52 chore: Update dist
5188626 chore(deps): bump @aws-sdk/client-sts from 3.803.0 to 3.808.0 (#1353)
a7d7b78 chore: Update dist
e10de4c chore(deps-dev): bump @aws-sdk/credential-provider-env (#1352)
85f7c4c chore(deps-dev): bump @types/node from 22.15.11 to 22.15.17 (#1351)
See full diff in compare view

Updates anchore/sbom-action from 0.19.0 to 0.20.0

Release notes

Sourced from anchore/sbom-action's releases.

v0.20.0

Changes in v0.20.0

chore(deps): update Syft to v1.24.0 (#522)

Commits

e11c554 chore(deps): update Syft to v1.24.0 (#522)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…#7797) Bumps the actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6.16.0` | `6.17.0` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.4.2` | `5.4.3` | | [github/codeql-action](https://github.com/github/codeql-action) | `3.28.17` | `3.28.18` | | [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action) | `19.1.0` | `20.0.0` | | [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `4.2.0` | `4.2.1` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.19.0` | `0.20.0` | Updates `docker/build-push-action` from 6.16.0 to 6.17.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@14487ce...1dc7386) Updates `codecov/codecov-action` from 5.4.2 to 5.4.3 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@ad3126e...18283e0) Updates `github/codeql-action` from 3.28.17 to 3.28.18 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@60168ef...ff0a06e) Updates `DavidAnson/markdownlint-cli2-action` from 19.1.0 to 20.0.0 - [Release notes](https://github.com/davidanson/markdownlint-cli2-action/releases) - [Commits](DavidAnson/markdownlint-cli2-action@05f3221...992badc) Updates `aws-actions/configure-aws-credentials` from 4.2.0 to 4.2.1 - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](aws-actions/configure-aws-credentials@f24d719...b475783) Updates `anchore/sbom-action` from 0.19.0 to 0.20.0 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](anchore/sbom-action@9f73021...e11c554) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: 6.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: codecov/codecov-action dependency-version: 5.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action dependency-version: 3.28.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: DavidAnson/markdownlint-cli2-action dependency-version: 20.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: aws-actions/configure-aws-credentials dependency-version: 4.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: anchore/sbom-action dependency-version: 0.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jakub Jarosz <[email protected]>

…7abbb4427a90d7a5c749332005e

nginx-bot requested a review from a team as a code owner May 26, 2025 09:17

nginx-bot added chore Pull requests for routine tasks dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code labels May 26, 2025

github-actions bot removed the dependencies Pull requests that update a dependency file label May 26, 2025

AlexFenlon approved these changes May 27, 2025

View reviewed changes

jjngx approved these changes May 27, 2025

View reviewed changes

Merge branch 'release-5.0' into cherry-pick-release-5.0-38094d2290d44…

e2592f9

…7abbb4427a90d7a5c749332005e

jjngx merged commit fa79e90 into release-5.0 May 28, 2025
72 checks passed

jjngx deleted the cherry-pick-release-5.0-38094d2290d447abbb4427a90d7a5c749332005e branch May 28, 2025 08:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[cherry-pick] chore(deps): bump the actions group across 1 directory with 6 updates #7836

[cherry-pick] chore(deps): bump the actions group across 1 directory with 6 updates #7836

Uh oh!

nginx-bot commented May 26, 2025

Uh oh!

Uh oh!

Uh oh!

[cherry-pick] chore(deps): bump the actions group across 1 directory with 6 updates #7836

[cherry-pick] chore(deps): bump the actions group across 1 directory with 6 updates #7836

Uh oh!

Conversation

nginx-bot commented May 26, 2025

v6.17.0

v5.4.3

What's Changed

v5.4.3

What's Changed

v5.4.2

What's Changed

v5.4.1

What's Changed

v5.4.0

What's Changed

v3.28.18

CodeQL Action Changelog

3.28.18 - 16 May 2025

CodeQL Action Changelog

[UNRELEASED]

3.28.18 - 16 May 2025

3.28.17 - 02 May 2025

3.28.16 - 23 Apr 2025

3.28.15 - 07 Apr 2025

3.28.14 - 07 Apr 2025

3.28.13 - 24 Mar 2025

3.28.12 - 19 Mar 2025

3.28.11 - 07 Mar 2025

3.28.10 - 21 Feb 2025

3.28.9 - 07 Feb 2025

v4.2.1

4.2.1 (2025-05-14)

Bug Fixes

Changelog

4.2.1 (2025-05-14)

Bug Fixes

4.2.0 (2025-05-06)

Features

Bug Fixes

4.1.0 (2025-02-08)

Features

Bug Fixes

4.0.3 (2025-01-27)

Features

v0.20.0

Changes in v0.20.0

Uh oh!

Uh oh!

Uh oh!