Skip to content

chore(deps): bump the actions-version-updates group across 1 directory with 15 updates #89

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: beta
Choose a base branch
from
Open

chore(deps): bump the actions-version-updates group across 1 directory with 15 updates #89

dependabot wants to merge 1 commit into from
+43 −43

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 22, 2025

Bumps the actions-version-updates group with 15 updates in the / directory:

Package From To
step-security/harden-runner 2.12.0 2.14.0
actions/checkout 4.2.2 6.0.1
actions/dependency-review-action 4.7.1 4.8.2
docker/setup-buildx-action 3.10.0 3.12.0
docker/build-push-action 6.17.0 6.18.0
astral-sh/setup-uv 4 7
stefanzweifel/git-auto-commit-action 5.2.0 7.1.0
actions/download-artifact 4.3.0 7.0.0
JetBrains/qodana-action 201551778d1453e36c5c0aa26f89a94775cb1acc f5aa2889b113c16bd6aee47817b027537ee33ac7
actions/setup-node 4.4.0 6.1.0
mridang/action-semantic-release 1 2
ossf/scorecard-action 2.4.1 2.4.3
github/codeql-action 3.28.18 4.31.9
actions/upload-artifact 4.6.2 6.0.0
dorny/test-reporter 2.0.0 2.3.0

Updates step-security/harden-runner from 2.12.0 to 2.14.0

Release notes

Sourced from step-security/harden-runner's releases.

v2.14.0

What's Changed

  • Selective installation: Harden-Runner now skips installation on GitHub-hosted runners when the repository has a custom property skip_harden_runner, allowing organizations to opt out specific repos.
  • Avoid double install: The action no longer installs Harden-Runner if it’s already present on a GitHub-hosted runner, which could happen when a composite action also installs it.

Full Changelog: step-security/harden-runner@v2.13.3...v2.14.0

v2.13.3

What's Changed

  • Fixed an issue where process events were not uploaded in certain edge cases.

Full Changelog: step-security/harden-runner@v2.13.2...v2.13.3

v2.13.2

What's Changed

  • Fixed an issue where there was a limit of 512 allowed endpoints when using block egress policy. This restriction has been removed, allowing for an unlimited number of endpoints to be configured.
  • Harden Runner now automatically detects if the agent is already pre-installed on a custom VM image used by a GitHub-hosted runner. When detected, the action will skip reinstallation and use the existing agent.

Full Changelog: step-security/harden-runner@v2.13.1...v2.13.2

v2.13.1

What's Changed

  • Graceful handling of HTTP errors: Improved error handling when fetching Harden Runner policies from the StepSecurity Policy Store API, ensuring more reliable execution even in case of temporary network/API issues.

  • Security updates for npm dependencies: Updated vulnerable npm package dependencies to the latest secure versions.

  • Faster enterprise agent downloads: The enterprise agent is now downloaded from GitHub Releases instead of packages.stepsecurity.io, improving download speed and reliability.

Full Changelog: step-security/harden-runner@v2.13.0...v2.13.1

v2.13.0

What's Changed

  • Improved job markdown summary
  • Https monitoring for all domains (included with the enterprise tier)

Full Changelog: step-security/harden-runner@v2...v2.13.0

v2.12.2

What's Changed

Added HTTPS Monitoring for additional destinations - *.githubusercontent.com Bug fixes:

  • Implicitly allow local multicast, local unicast and broadcast IP addresses in block mode
  • Increased policy map size for block mode

... (truncated)

Commits
  • 20cf305 Merge pull request #622 from step-security/feature/custom-property-skip
  • c51e8ee feat: skip agent install and post step on subsequent runs for GitHub-hosted r...
  • e152b90 feat: skip harden-runner based on repository custom property
  • ee1faec feat: replace skip-harden-runner with skip-on-custom-property input
  • 1dc7c17 feat: add skip-harden-runner input to conditionally skip execution
  • df199fb Merge pull request #620 from step-security/rc-29
  • 03d096a update agent
  • 4090107 fix: update agent
  • 95d9a5d Merge pull request #606 from step-security/rc-28
  • 87e429d Update limitations.md
  • Additional commits viewable in compare view

Updates actions/checkout from 4.2.2 to 6.0.1

Release notes

Sourced from actions/checkout's releases.

v6.0.1

What's Changed

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.1

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v4.1.5

... (truncated)

Commits

Updates actions/dependency-review-action from 4.7.1 to 4.8.2

Release notes

Sourced from actions/dependency-review-action's releases.

v4.8.2

Minor fixes:

Dependency Review Action v4.8.1

What's Changed

Full Changelog: actions/dependency-review-action@v4...v4.8.1

v4.8.0

What's Changed

New Contributors

Full Changelog: actions/dependency-review-action@v4...v4.8.0

4.7.3

What's Changed

Full Changelog: actions/dependency-review-action@v4...v4.7.3

4.7.2

What's Changed

New Contributors

Full Changelog: actions/dependency-review-action@v4...v4.7.2

Commits
  • 3c4e3dc Merge pull request #1016 from actions/dra-release
  • 02930b2 Update CONTRIBUTING to reflect new guidelines
  • 49ffd9f Update CONTRIBUTING to reflect the need to build
  • 70cb25e 4.8.2 release
  • ebabd31 Merge pull request #1008 from danielhardej/danielhardej-patch-20251023
  • 19f9360 Update package-lock.json
  • 5fd2f98 Bump @​types/jest to version 29.5.14
  • 28647f4 Fix PURL parsing by removing encodeURI
  • f620fd1 Merge pull request #1013 from actions/dangoor/token-fix
  • 9b42b7e Remove bad token reference
  • Additional commits viewable in compare view

Updates docker/setup-buildx-action from 3.10.0 to 3.12.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v3.12.0

Full Changelog: docker/setup-buildx-action@v3.11.1...v3.12.0

v3.11.1

Full Changelog: docker/setup-buildx-action@v3.11.0...v3.11.1

v3.11.0

Full Changelog: docker/setup-buildx-action@v3.10.0...v3.11.0

Commits
  • 8d2750c Merge pull request #455 from crazy-max/install-deprecated
  • e81846b deprecate install input
  • 65d18f8 Merge pull request #454 from docker/dependabot/github_actions/actions/checkout-6
  • 000d75d build(deps): bump actions/checkout from 5 to 6
  • 1583c0f Merge pull request #443 from nicolasleger/patch-1
  • ed158e7 doc: bump actions/checkout from 4 to 5
  • 4cc794f Merge pull request #441 from docker/dependabot/github_actions/actions/checkout-5
  • 4dfc3d6 build(deps): bump actions/checkout from 4 to 5
  • af1b253 Merge pull request #440 from crazy-max/k3s-build
  • 3c6ab92 ci: k3s test with latest buildx
  • Additional commits viewable in compare view

Updates docker/build-push-action from 6.17.0 to 6.18.0

Release notes

Sourced from docker/build-push-action's releases.

v6.18.0

[!NOTE] Build summary is now supported with Docker Build Cloud.

Full Changelog: docker/build-push-action@v6.17.0...v6.18.0

Commits
  • 2634353 Merge pull request #1381 from docker/dependabot/npm_and_yarn/docker/actions-t...
  • c0432d2 chore: update generated content
  • 0bb1f27 set builder driver and endpoint attributes for dbc summary support
  • 5f9dbf9 chore(deps): Bump @​docker/actions-toolkit from 0.61.0 to 0.62.1
  • 0788c44 Merge pull request #1375 from crazy-max/remove-gcr
  • aa179ca e2e: remove GCR
  • See full diff in compare view

Updates astral-sh/setup-uv from 4 to 7

Release notes

Sourced from astral-sh/setup-uv's releases.

v7.0.0 🌈 node24 and a lot of bugfixes

Changes

This release comes with a load of bug fixes and a speed up. Because of switching from node20 to node24 it is also a breaking change. If you are running on GitHub hosted runners this will just work, if you are using self-hosted runners make sure, that your runners are up to date. If you followed the normal installation instructions your self-hosted runner will keep itself updated.

This release also removes the deprecated input server-url which was used to download uv releases from a different server. The manifest-file input supersedes that functionality by adding a flexible way to define available versions and where they should be downloaded from.

Fixes

  • The action now respects when the environment variable UV_CACHE_DIR is already set and does not overwrite it. It now also finds cache-dir settings in config files if you set them.
  • Some users encountered problems that cache pruning took forever because they had some uv processes running in the background. Starting with uv version 0.8.24 this action uses uv cache prune --ci --force to ignore the running processes
  • If you just want to install uv but not have it available in path, this action now respects UV_NO_MODIFY_PATH
  • Some other actions also set the env var UV_CACHE_DIR. This action can now deal with that but as this could lead to unwanted behavior in some edgecases a warning is now displayed.

Improvements

If you are using minimum version specifiers for the version of uv to install for example

[tool.uv]
required-version = ">=0.8.17"

This action now detects that and directly uses the latest version. Previously it would download all available releases from the uv repo to determine the highest matching candidate for the version specifier, which took much more time.

If you are using other specifiers like 0.8.x this action still needs to download all available releases because the specifier defines an upper bound (not 0.9.0 or later) and "latest" would possibly not satisfy that.

🚨 Breaking changes

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

... (truncated)

Commits
  • 681c641 Bump actions/checkout from 5.0.0 to 6.0.1 (#712)
  • 2e85713 Bump actions/setup-node from 6.0.0 to 6.1.0 (#715)
  • 58b6d7b fix: add OS version to cache key to prevent binary incompatibility (#716)
  • e8b52af chore: update known checksums for 0.9.17 (#714)
  • ed21f2f Bump peter-evans/create-pull-request from 7.0.8 to 7.0.9 (#695)
  • 93202d8 bump dependencies (#709)
  • 5ce0900 set biome files.maxSize to 2MiB (#708)
  • 4180991 allow cache-local-path w/o enable-cache (#707)
  • 0439606 Bump github/codeql-action from 4.30.9 to 4.31.6 (#698)
  • 7dd56c1 chore: update known checksums for 0.9.16 (#706)
  • Additional commits viewable in compare view

Updates stefanzweifel/git-auto-commit-action from 5.2.0 to 7.1.0

Release notes

Sourced from stefanzweifel/git-auto-commit-action's releases.

v7.1.0

Added

Changes

Dependency Updates

v7.0.0

Added

Changed

Dependency Updates

v6.0.1

Fixed

v6.0.0

Added

  • Throw error early if repository is in a detached state (#357)

Fixed

Removed

  • Remove support for create_branch, skip_checkout, skip_Fetch (#314)
Changelog

Sourced from stefanzweifel/git-auto-commit-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Unreleased

TBD

v7.1.0 - 2025-12-17

Added

Changes

Dependency Updates

v7.0.0 - 2025-10-12

Added

Changed

Dependency Updates

v6.0.1 - 2025-06-11

Fixed

v6.0.0 - 2025-06-10

... (truncated)

Commits

Updates actions/download-artifact from 4.3.0 to 7.0.0

Release notes

Sourced from actions/download-artifact's releases.

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

v6.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

New Contributors

Full Changelog: actions/download-artifact@v5...v6.0.0

v5.0.0

What's Changed

v5.0.0

🚨 Breaking Change

This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.

What Changed

... (truncated)

Commits
  • 37930b1 Merge pull request #452 from actions/download-artifact-v7-release
  • 72582b9 doc: update readme
  • 0d2ec9d chore: release v7.0.0 for Node.js 24 support
  • fd7ae8f Merge pull request #451 from actions/fix-storage-blob
  • d484700 chore: restore minimatch.dep.yml license file
  • 03a8080 chore: remove obsolete dependency license files
  • 56fe6d9 chore: update @​actions/artifact license file to 5.0.1
  • 8e3ebc4 chore: update package-lock.json with @​actions/artifact@​5.0.1
  • 1e3c4b4 fix: update @​actions/artifact to ^5.0.0 for Node.js 24 punycode fix
  • 458627d chore: use local @​actions/artifact package for Node.js 24 testing
  • Additional commits viewable in compare view

Updates JetBrains/qodana-action from 201551778d1453e36c5c0aa26f89a94775cb1acc to f5aa2889b113c16bd6aee47817b027537ee33ac7

Commits
  • f5aa288 🐛 QD-11047 fix issue with quick-fixes: pull-request (#490)
  • 26b380e 🐛 QD-11047 fix issue with quick-fixes in gitlab in branch mode (#482)
  • See full diff in compare view

Updates actions/setup-node from 4.4.0 to 6.1.0

Release notes

Sourced from actions/setup-node's releases.

v6.1.0

What's Changed

Enhancement:

Dependency updates:

Documentation update:

Full Changelog: actions/setup-node@v6...v6.1.0

v6.0.0

What's Changed

Breaking Changes

Dependency Upgrades

  • Upgrade ts-jest from 29.1.2 to 29.4.1 and document breaking changes in v5 by @​dependabot[bot] in #1336
    • ...

    Description has been truncated

@dependabot
chore(deps): bump the actions-version-updates group across 1 director…
1ceb8d4 
…y with 15 updates

Bumps the actions-version-updates group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.12.0` | `2.14.0` |
| [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `6.0.1` |
| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.7.1` | `4.8.2` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.10.0` | `3.12.0` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `6.17.0` | `6.18.0` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `4` | `7` |
| [stefanzweifel/git-auto-commit-action](https://github.com/stefanzweifel/git-auto-commit-action) | `5.2.0` | `7.1.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `7.0.0` |
| [JetBrains/qodana-action](https://github.com/jetbrains/qodana-action) | `201551778d1453e36c5c0aa26f89a94775cb1acc` | `f5aa2889b113c16bd6aee47817b027537ee33ac7` |
| [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `6.1.0` |
| [mridang/action-semantic-release](https://github.com/mridang/action-semantic-release) | `1` | `2` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.1` | `2.4.3` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3.28.18` | `4.31.9` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `6.0.0` |
| [dorny/test-reporter](https://github.com/dorny/test-reporter) | `2.0.0` | `2.3.0` |



Updates `step-security/harden-runner` from 2.12.0 to 2.14.0
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@0634a26...20cf305)

Updates `actions/checkout` from 4.2.2 to 6.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11bd719...8e8c483)

Updates `actions/dependency-review-action` from 4.7.1 to 4.8.2
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@da24556...3c4e3dc)

Updates `docker/setup-buildx-action` from 3.10.0 to 3.12.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@b5ca514...8d2750c)

Updates `docker/build-push-action` from 6.17.0 to 6.18.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@1dc7386...2634353)

Updates `astral-sh/setup-uv` from 4 to 7
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@v4...v7)

Updates `stefanzweifel/git-auto-commit-action` from 5.2.0 to 7.1.0
- [Release notes](https://github.com/stefanzweifel/git-auto-commit-action/releases)
- [Changelog](https://github.com/stefanzweifel/git-auto-commit-action/blob/master/CHANGELOG.md)
- [Commits](stefanzweifel/git-auto-commit-action@b863ae1...04702ed)

Updates `actions/download-artifact` from 4.3.0 to 7.0.0
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@d3f86a1...37930b1)

Updates `JetBrains/qodana-action` from 201551778d1453e36c5c0aa26f89a94775cb1acc to f5aa2889b113c16bd6aee47817b027537ee33ac7
- [Release notes](https://github.com/jetbrains/qodana-action/releases)
- [Commits](JetBrains/qodana-action@2015517...f5aa288)

Updates `actions/setup-node` from 4.4.0 to 6.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@49933ea...395ad32)

Updates `mridang/action-semantic-release` from 1 to 2
- [Release notes](https://github.com/mridang/action-semantic-release/releases)
- [Changelog](https://github.com/mridang/action-semantic-release/blob/master/release.config.mjs)
- [Commits](mridang/action-semantic-release@v1...v2)

Updates `ossf/scorecard-action` from 2.4.1 to 2.4.3
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@f49aabe...4eaacf0)

Updates `github/codeql-action` from 3.28.18 to 4.31.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@ff0a06e...5d4e8d1)

Updates `actions/upload-artifact` from 4.6.2 to 6.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@ea165f8...b7c566a)

Updates `dorny/test-reporter` from 2.0.0 to 2.3.0
- [Release notes](https://github.com/dorny/test-reporter/releases)
- [Changelog](https://github.com/dorny/test-reporter/blob/main/CHANGELOG.md)
- [Commits](dorny/test-reporter@6e6a65b...fe45e95)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-version-updates
- dependency-name: actions/checkout
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-version-updates
- dependency-name: actions/dependency-review-action
  dependency-version: 4.8.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-version-updates
- dependency-name: docker/setup-buildx-action
  dependency-version: 3.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-version-updates
- dependency-name: docker/build-push-action
  dependency-version: 6.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-version-updates
- dependency-name: astral-sh/setup-uv
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-version-updates
- dependency-name: stefanzweifel/git-auto-commit-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-version-updates
- dependency-name: actions/download-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-version-updates
- dependency-name: JetBrains/qodana-action
  dependency-version: f5aa2889b113c16bd6aee47817b027537ee33ac7
  dependency-type: direct:production
  dependency-group: actions-version-updates
- dependency-name: actions/setup-node
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-version-updates
- dependency-name: mridang/action-semantic-release
  dependency-version: '2'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-version-updates
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-version-updates
- dependency-name: github/codeql-action
  dependency-version: 4.31.9
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-version-updates
- dependency-name: actions/upload-artifact
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-version-updates
- dependency-name: dorny/test-reporter
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-version-updates
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Dec 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant