Skip to content

chore(deps): bump the github-actions group with 11 updates - #92

Closed
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/github_actions/github-actions-48cf1656db
Closed

chore(deps): bump the github-actions group with 11 updates#92
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/github_actions/github-actions-48cf1656db

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 11 updates:

Package From To
step-security/harden-runner 2.21.0 2.21.1
hendrikmuhs/ccache-action 1.2.23 1.2.24
crate-ci/typos 1.49.0 1.50.0
anchore/scan-action 7.4.0 7.4.2
bridgecrewio/checkov-action 12.3119.0 12.3122.0
github/codeql-action/upload-sarif 4.37.8 4.37.9
github/codeql-action/init 4.37.8 4.37.9
github/codeql-action/autobuild 4.37.8 4.37.9
github/codeql-action/analyze 4.37.8 4.37.9
r-lib/actions/setup-r 2.12.1 2.13.0
taiki-e/install-action 2.86.7 2.87.2

Updates step-security/harden-runner from 2.21.0 to 2.21.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.21.1

What's Changed

  • Improved performance of the disable-sudo feature.
  • Fixed an issue in the Community tier where new endpoints required by the GitHub Actions runner were not being implicitly allowed in block mode.
  • Fixed the Harden-Runner post step failing on Linux distributions that do not have a merged /usr filesystem layout (for example Debian 11), where /usr/bin/echo does not exist. This mainly affected self-hosted runners.
  • Documentation updates: clarified which features are in the Community (free) vs Enterprise tier.

Full Changelog: step-security/harden-runner@v2.21.0...v2.21.1

Commits
  • e14015d Merge pull request #690 from step-security/rc-43
  • 9001249 docs: update harden-runner version pin to v2.21.0 in getting started example
  • a447fba docs: expand enterprise feature list and document custom VM and ubuntu-slim l...
  • b0eaf8d docs: clarify community vs enterprise tiers and add maintained actions section
  • 063e8e3 Merge pull request #687 from rohan-stepsecurity/rp/fix/bin-echo-fallback
  • f46bdc1 chore: bump agent-ebpf to v1.9.1 and agent to v0.16.3
  • 42e6daa fix: fall back to /bin/echo for non-usr-merged distros
  • See full diff in compare view

Updates hendrikmuhs/ccache-action from 1.2.23 to 1.2.24

Release notes

Sourced from hendrikmuhs/ccache-action's releases.

v1.2.24

What's Changed

dependabot updates

Full Changelog: hendrikmuhs/ccache-action@v1.2.23...v1.2.24

Commits

Updates crate-ci/typos from 1.49.0 to 1.50.0

Release notes

Sourced from crate-ci/typos's releases.

v1.50.0

[1.50.0] - 2026-08-28

Features

v1.49.1

[1.49.1] - 2026-08-27

Fixes

  • Don't correct the brand name HashiCorp
Changelog

Sourced from crate-ci/typos's changelog.

Change Log

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

[Unreleased] - ReleaseDate

[1.50.1] - 2026-09-01

Fixes

  • Don't correct asend in Python code

[1.50.0] - 2026-08-28

Features

[1.49.1] - 2026-08-27

Fixes

  • Don't correct the brand name HashiCorp

[1.49.0] - 2026-08-03

Features

  • Updated the dictionary with the July 2026 changes

[1.48.0] - 2026-06-30

Features

  • Updated the dictionary with the June 2026 changes

[1.47.2] - 2026-06-04

Fixes

  • Don't correct inferrable
  • Correct unused inferible variant

[1.47.1] - 2026-06-03

Fixes

... (truncated)

Commits

Updates anchore/scan-action from 7.4.0 to 7.4.2

Release notes

Sourced from anchore/scan-action's releases.

v7.4.2

Additional Changes

(Full Changelog)

Commits
  • 27805bf chore(deps): update Grype to latest release (#755) (#756)
  • 8964e60 chore(deps): update Grype to latest release (#755)
  • 6875336 chore: bump fast-xml-parser from 5.5.8 to 5.7.3 (#654)
  • 65b5fb1 chore: bump esbuild from 0.28.0 to 0.28.2 (#753)
  • b905e0e chore(deps): update Grype to latest release (#713)
  • e49c028 fix: pin grype install.sh to the release tag being installed (#750)
  • db8f0b6 chore: bump globals from 17.9.0 to 17.11.0 (#754)
  • 35bf076 chore: bump eslint from 10.8.0 to 10.8.1 (#752)
  • bd77fb5 chore: bump anchore/workflows/.github/workflows/check-gate.yaml (#720)
  • d04f6c4 chore: bump lint-staged from 17.2.0 to 17.3.0 (#748)
  • Additional commits viewable in compare view

Updates bridgecrewio/checkov-action from 12.3119.0 to 12.3122.0

Commits
  • f967808 Bump checkov container version to 3.3.16
  • 5659dde Bump checkov container version to 3.3.15
  • ec0fde7 Bump checkov container version to 3.3.14
  • See full diff in compare view

Updates github/codeql-action/upload-sarif from 4.37.8 to 4.37.9

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.37.9

  • Update default CodeQL bundle version to 2.26.4. #4106
Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
  • Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

  • Update default CodeQL bundle version to 2.26.0. #3995

... (truncated)

Commits
  • cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
  • 7243f38 Update changelog for v4.37.9
  • 920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
  • ecfa6e1 Add changelog note
  • adcdf4a Update default bundle to codeql-bundle-v2.26.4
  • 486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
  • 134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
  • ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
  • 4605e03 Rebuild
  • 099c869 Update changelog and version after v4.37.8
  • Additional commits viewable in compare view

Updates github/codeql-action/init from 4.37.8 to 4.37.9

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.9

  • Update default CodeQL bundle version to 2.26.4. #4106
Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
  • Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

  • Update default CodeQL bundle version to 2.26.0. #3995

... (truncated)

Commits
  • cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
  • 7243f38 Update changelog for v4.37.9
  • 920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
  • ecfa6e1 Add changelog note
  • adcdf4a Update default bundle to codeql-bundle-v2.26.4
  • 486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
  • 134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
  • ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
  • 4605e03 Rebuild
  • 099c869 Update changelog and version after v4.37.8
  • Additional commits viewable in compare view

Updates github/codeql-action/autobuild from 4.37.8 to 4.37.9

Release notes

Sourced from github/codeql-action/autobuild's releases.

v4.37.9

  • Update default CodeQL bundle version to 2.26.4. #4106
Changelog

Sourced from github/codeql-action/autobuild's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
  • Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

  • Update default CodeQL bundle version to 2.26.0. #3995

... (truncated)

Commits
  • cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
  • 7243f38 Update changelog for v4.37.9
  • 920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
  • ecfa6e1 Add changelog note
  • adcdf4a Update default bundle to codeql-bundle-v2.26.4
  • 486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
  • 134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
  • ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
  • 4605e03 Rebuild
  • 099c869 Update changelog and version after v4.37.8
  • Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.8 to 4.37.9

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.9

  • Update default CodeQL bundle version to 2.26.4. #4106
Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
  • Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

  • Update default CodeQL bundle version to 2.26.0. #3995

... (truncated)

Commits
  • cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
  • 7243f38 Update changelog for v4.37.9
  • 920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
  • ecfa6e1 Add changelog note
  • adcdf4a Update default bundle to codeql-bundle-v2.26.4
  • 486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
  • 134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
  • ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
  • 4605e03 Rebuild
  • 099c869 Update changelog and version after v4.37.8
  • Additional commits viewable in compare view

Updates r-lib/actions/setup-r from 2.12.1 to 2.13.0

Changelog

Sourced from r-lib/actions/setup-r's changelog.

v2.13.0 (2026-08028)

  • [setup-r] now retries r-hub.io HTTP failures (#1088, @​nbenn).

  • [setup-r] now sets the correct RTOOLS environment variables on aarch64 Windows (@​vjymisal0, #1104).

  • [setup-r] keep repositories if they are set by the build. E.g. aarch64 Windows builds now set them (@​jeroen, #1101).

  • [setup-r] now retries transient failures when resolving the R version from api.r-hub.io, rather than failing the job on the first timeout or server error (@​nbenn, #1086).

  • [setup-r-dependencies] now switches back to classic sudo, if available, on Linux. This fixes installing pak on Ubuntu 26.04 runners (@​jeroen, #1096).

v2.12.1 (2026-06-23)

  • [setup-r] now avoids a warning about an url.parse() deprecation (#1074).

  • [setup-r-dependencies] now uses quarto-dev/quarto-actions v2.2.0 (@​jdblischak, #1076).

  • Examples: test-coverage.yaml now uses codecov/codecov-action v7 (@​shikokuchuo, #1081).

  • New example claude-investigate.yaml workflow (@​DavisVaughan, #1084).

v2.12.0 (2026-04-29)

  • All node.js actions use node 24 now. Relatedly, all example workflows use recent versions of actions that use node 24.

  • [setup-r] now uses use-public-rspm: true by default on Linux and Windows. macOS binaries require further opt-in with use-public-rspm: always.

  • It is now possible to require actions to be pinned to a full-length commit SHA in repositories using r-lib/actions (#1070).

  • [setup-pandoc][setup-r-dependencies] now default to Pandoc version 3.8.3.

  • [setup-r-dependencies] now includes the R architecture in the cache key, so caches for macos-15 (Apple Silicon) and macos-15-intel (Rosetta/x86_64) no longer collide (#1035).

... (truncated)

Commits
  • 465b7d8 NEWS for 2.13.0 (#1105)
  • d06a540 [setup-r] retry transient r-hub.io request failures (#1088)
  • ed9aa85 fix(setup-r): export correct RTOOLS HOME env vars on Windows ARM64 and x64 (#...
  • c86f32c setup-r-dependencies: set JAVA_HOME on Windows runners from Java 21 env vars ...
  • 2a66450 setup-r-dependencies: switch back to classic sudo on runners with sudo-rs (#1...
  • 5cc1f0d Fix minor typo (#1098)
  • 33d09fb fix: Remove stray ::group:: (#1103)
  • aae88a2 Special-case CRAN mirror for Windows ARM64 (#1101)
  • b7484da [setup-r] Support installing RTools without installing R (#1093)
  • See full diff in compare view

Updates taiki-e/install-action from 2.86.7 to 2.87.2

Release notes

Sourced from taiki-e/install-action's releases.

2.87.2

  • Update typos@latest to 1.50.0.

  • Update tombi@latest to 1.5.0.

  • Update shfmt@latest to 3.14.0.

2.87.1

  • Update uv@latest to 0.12.7.

  • Update typos@latest to 1.49.1.

  • Update syft@latest to 1.51.1.

  • Update prek@latest to 0.5.0.

  • Update d2@latest to 0.8.2.

  • Update cargo-zigbuild@latest to 0.23.3.

  • Update cargo-rdme@latest to 2.2.2.

  • Update biome@latest to 2.5.11.

2.87.0

  • Support kache. (#1980, thanks @​ChrisJr404)

  • Update vacuum@latest to 0.30.1.

  • Update uv@latest to 0.12.6.

  • Update mise@latest to 2026.8.14.

  • Update editorconfig-checker@latest to 3.11.2.

2.86.8

  • Update wasmtime@latest to 48.0.1.

  • Update wasm-tools@latest to 1.258.0.

  • Update oxfmt@latest to 1.80.0.

  • Update mise@latest to 2026.8.12.

  • Update kingfisher@latest to 2.0.0.

  • Update cargo-zigbuild@latest to 0.23.2.

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.87.7] - 2026-09-06

  • Update wasm-bindgen@latest to 0.2.128.

  • Update uv@latest to 0.12.10.

  • Update tombi@latest to 1.5.2.

  • Update rclone@latest to 1.75.1.

[2.87.6] - 2026-09-05

  • Update rafn@latest to 0.1.6.

  • Update editorconfig-checker@latest to 3.11.3.

  • Update dprint@latest to 0.57.1.

  • Update convco@latest to 0.7.2.

[2.87.5] - 2026-09-04

  • Update vacuum@latest to 0.30.3.

  • Update uv@latest to 0.12.9.

  • Update typos@latest to 1.50.1.

  • Update tombi@latest to 1.5.1.

  • Update release-plz@latest to 0.3.161.

  • Update prek@latest to 0.5.2.

  • Update oxfmt@latest to 1.81.0.

  • Update mise@latest to 2026.9.1.

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<detai...

Description has been truncated

@dependabot
chore(deps): bump the github-actions group with 11 updates
11bf5e4 
Bumps the github-actions group with 11 updates:

| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.21.0` | `2.21.1` |
| [hendrikmuhs/ccache-action](https://github.com/hendrikmuhs/ccache-action) | `1.2.23` | `1.2.24` |
| [crate-ci/typos](https://github.com/crate-ci/typos) | `1.49.0` | `1.50.0` |
| [anchore/scan-action](https://github.com/anchore/scan-action) | `7.4.0` | `7.4.2` |
| [bridgecrewio/checkov-action](https://github.com/bridgecrewio/checkov-action) | `12.3119.0` | `12.3122.0` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.8` | `4.37.9` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.8` | `4.37.9` |
| [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.37.8` | `4.37.9` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.8` | `4.37.9` |
| [r-lib/actions/setup-r](https://github.com/r-lib/actions) | `2.12.1` | `2.13.0` |
| [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.86.7` | `2.87.2` |


Updates `step-security/harden-runner` from 2.21.0 to 2.21.1
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@05e3151...e14015d)

Updates `hendrikmuhs/ccache-action` from 1.2.23 to 1.2.24
- [Release notes](https://github.com/hendrikmuhs/ccache-action/releases)
- [Commits](hendrikmuhs/ccache-action@d62db5f...f09c25b)

Updates `crate-ci/typos` from 1.49.0 to 1.50.0
- [Release notes](https://github.com/crate-ci/typos/releases)
- [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md)
- [Commits](crate-ci/typos@8a48f81...4d9c206)

Updates `anchore/scan-action` from 7.4.0 to 7.4.2
- [Release notes](https://github.com/anchore/scan-action/releases)
- [Changelog](https://github.com/anchore/scan-action/blob/main/RELEASE.md)
- [Commits](anchore/scan-action@e116508...27805bf)

Updates `bridgecrewio/checkov-action` from 12.3119.0 to 12.3122.0
- [Release notes](https://github.com/bridgecrewio/checkov-action/releases)
- [Commits](bridgecrewio/checkov-action@59b9d7e...f967808)

Updates `github/codeql-action/upload-sarif` from 4.37.8 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@db488dd...cdf488f)

Updates `github/codeql-action/init` from 4.37.8 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@db488dd...cdf488f)

Updates `github/codeql-action/autobuild` from 4.37.8 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@db488dd...cdf488f)

Updates `github/codeql-action/analyze` from 4.37.8 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@db488dd...cdf488f)

Updates `r-lib/actions/setup-r` from 2.12.1 to 2.13.0
- [Release notes](https://github.com/r-lib/actions/releases)
- [Changelog](https://github.com/r-lib/actions/blob/v2-branch/NEWS.md)
- [Commits](r-lib/actions@d3c5be5...465b7d8)

Updates `taiki-e/install-action` from 2.86.7 to 2.87.2
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](taiki-e/install-action@b6ff580...1ed6d7b)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: hendrikmuhs/ccache-action
  dependency-version: 1.2.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: crate-ci/typos
  dependency-version: 1.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: anchore/scan-action
  dependency-version: 7.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: bridgecrewio/checkov-action
  dependency-version: 12.3122.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: r-lib/actions/setup-r
  dependency-version: 2.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: taiki-e/install-action
  dependency-version: 2.87.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added ci dependencies Pull requests that update a dependency file labels Sep 7, 2026
@dependabot
dependabot Bot requested a review from rldyourmnd as a code owner September 7, 2026 06:39
@dependabot dependabot Bot added ci dependencies Pull requests that update a dependency file labels Sep 7, 2026
This was referenced Sep 7, 2026
Merged
Merged
@rldyourmnd

rldyourmnd commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

Superseded by merged #97 (bc9c791). All eight upstream action updates were independently verified and reapplied to current main, including matching catalogs, Checkov image and generated references. Full local validation, actionlint and authenticated pinned zizmor passed. Original failed runs remain failures; this is an explicit replacement disposition.

@rldyourmnd rldyourmnd closed this Sep 7, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/github_actions/github-actions-48cf1656db branch September 7, 2026 12:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rldyourmnd rldyourmnd Awaiting requested review from rldyourmnd rldyourmnd is a code owner

Assignees

No one assigned

Labels

ci dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rldyourmnd