Skip to content

chore(deps): bump the actions-deps group with 15 updates #377

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

chore(deps): bump the actions-deps group with 15 updates #377

wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 17, 2025 •
edited
Loading

Bumps the actions-deps group with 15 updates:

Package From To
step-security/harden-runner 2.13.0 2.13.1
actions/checkout 4.2.2 5.0.0
tj-actions/changed-files 212f9a7760ad2b8eb511185b841f3725a62c2ae0 d03a93c0dbfac6d6dd6a0d8a5e7daff992b07449
codecov/codecov-action 5.4.3 5.5.1
anchore/scan-action 7.0.0 7.0.2
github/codeql-action 3.28.15 4.30.8
actions/download-artifact 4.3.0 5.0.0
softprops/action-gh-release 97d42c1b50f585f357413698aa1b779307aa0d52 5434409c2b6457c050f109d68b2547fcbf1db07b
docker/metadata-action 5.7.0 5.8.0
docker/login-action 3.4.0 3.6.0
peter-evans/dockerhub-description a701644270a123c7b02b318a8e4fe71e15a8f3cb 31b7155ea9926ec41d93d6c52a18d3022bfd128a
googleapis/release-please-action 4.2.0 4.3.0
iarekylew00t/verified-bot-commit 1.5.2 2.0.3
anchore/sbom-action 0.20.6 0.20.8
ossf/scorecard-action 2.4.1 2.4.3

Updates step-security/harden-runner from 2.13.0 to 2.13.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.13.1

What's Changed

  • Graceful handling of HTTP errors: Improved error handling when fetching Harden Runner policies from the StepSecurity Policy Store API, ensuring more reliable execution even in case of temporary network/API issues.

  • Security updates for npm dependencies: Updated vulnerable npm package dependencies to the latest secure versions.

  • Faster enterprise agent downloads: The enterprise agent is now downloaded from GitHub Releases instead of packages.stepsecurity.io, improving download speed and reliability.

Full Changelog: step-security/harden-runner@v2.13.0...v2.13.1

Commits
  • f4a75cf Merge pull request #588 from step-security/rc-26
  • 95503d0 ci: remove code-review workflow
  • 4b250a0 ci: add job to confirm dist is as expected
  • 5b0ab6a update dependencies
  • d11f2c1 fix bug where status code was not being preserved
  • b3fc98e improve error handling for policy store sceanrio
  • 92fc5d4 update error message
  • b61b0a4 policy store improvements
  • e3d3f2b use GitHub release instead of packages
  • 646ac01 update agent
  • Additional commits viewable in compare view

Updates actions/checkout from 4.2.2 to 5.0.0

Release notes

Sourced from actions/checkout's releases.

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v4...v4.3.0

Changelog

Sourced from actions/checkout's changelog.

Changelog

V5.0.0

V4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v4.1.5

v4.1.4

v4.1.3

... (truncated)

Commits

Updates tj-actions/changed-files from 212f9a7760ad2b8eb511185b841f3725a62c2ae0 to d03a93c0dbfac6d6dd6a0d8a5e7daff992b07449

Changelog

Sourced from tj-actions/changed-files's changelog.

Changelog

47.0.0 - (2025-09-13)

🚀 Features

➖ Remove

  • Commit and push step from build job (#2538) (be393a9) - (Tonye Jack)

🔄 Update

  • Updated README.md (#2592)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@​users.noreply.github.com> (3dbc1e1) - (github-actions[bot])

  • Updated README.md (#2591)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@​users.noreply.github.com> (b1ccff8) - (github-actions[bot])

  • Updated README.md (#2574)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@​users.noreply.github.com> (050a3d3) - (github-actions[bot])

📚 Documentation

  • Update link to glob patterns (#2590) (a892f50) - (Tonye Jack)
  • Add Jellyfrog as a contributor for code, and doc (#2573) (f000a9b) - (allcontributors[bot])

🧪 Testing

  • Manual triggered workflows (#2637) (c2ca249) - (Tonye Jack)

⚙️ Miscellaneous Tasks

  • deps-dev: Bump jest from 30.0.5 to 30.1.3 (#2655) (9a67555) - (dependabot[bot])
  • deps: Bump tj-actions/git-cliff from 2.1.0 to 2.2.0 (#2660) (b67e30d) - (dependabot[bot])
  • deps: Bump github/codeql-action from 3.30.2 to 3.30.3 (#2661) (62aef42) - (dependabot[bot])
  • deps: Bump github/codeql-action from 3.29.11 to 3.30.2 (#2659) (e874f3c) - (dependabot[bot])
  • deps: Bump actions/setup-node from 4.4.0 to 5.0.0 (#2656) (8c14441) - (dependabot[bot])
  • deps-dev: Bump @​types/node from 24.3.0 to 24.3.1 (#2657) (e995ac4) - (dependabot[bot])
  • deps-dev: Bump @​types/node from 24.2.1 to 24.3.0 (#2649) (3b04099) - (dependabot[bot])
  • deps: Bump github/codeql-action from 3.29.9 to 3.29.11 (#2651) (e7b6c97) - (dependabot[bot])
  • deps: Bump tj-actions/git-cliff from 2.0.2 to 2.1.0 (#2648) (765d62b) - (dependabot[bot])
  • deps: Bump github/codeql-action from 3.29.8 to 3.29.9 (#2647) (2036da1) - (dependabot[bot])
  • deps: Bump github/codeql-action from 3.29.7 to 3.29.8 (#2644) (239aef8) - (dependabot[bot])
  • deps-dev: Bump @​types/node from 24.2.0 to 24.2.1 (#2645) (a7d5f5f) - (dependabot[bot])
  • deps: Bump actions/checkout from 4.2.2 to 5.0.0 (#2646) (5107f3a) - (dependabot[bot])
  • deps-dev: Bump @​types/node from 24.1.0 to 24.2.0 (#2640) (f963b3f) - (dependabot[bot])
  • deps: Bump actions/download-artifact from 4.3.0 to 5.0.0 (#2641) (f956744) - (dependabot[bot])

... (truncated)

Commits
  • d03a93c chore(deps): bump github/codeql-action from 3.30.5 to 3.30.6 (#2680)
  • df9aabc chore(deps-dev): bump @​types/node from 24.6.1 to 24.6.2 (#2681)
  • d6f020b chore(deps-dev): bump @​types/node from 24.5.2 to 24.6.1 (#2679)
  • See full diff in compare view

Updates codecov/codecov-action from 5.4.3 to 5.5.1

Release notes

Sourced from codecov/codecov-action's releases.

v5.5.1

What's Changed

New Contributors

Full Changelog: codecov/codecov-action@v5.5.0...v5.5.1

v5.5.0

What's Changed

New Contributors

Full Changelog: codecov/codecov-action@v5.4.3...v5.5.0

Changelog

Sourced from codecov/codecov-action's changelog.

v5.5.1

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1

v5.5.0

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0

v5.4.3

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3

v5.4.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.1..v5.4.2

v5.4.1

... (truncated)

Commits

Updates anchore/scan-action from 7.0.0 to 7.0.2

Release notes

Sourced from anchore/scan-action's releases.

v7.0.2

New in scan-action v7.0.2

v7.0.1

scan-action v7.0.1

Commits
  • a5605eb chore(deps): update Grype to v0.101.1 (#532)
  • 9e84288 chore(deps): update Grype to v0.101.0 (#530)
  • 109c104 chore(deps): bump @​actions/cache from 4.0.3 to 4.1.0 (#522)
  • c455b6f chore(deps-dev): bump eslint from 9.36.0 to 9.37.0 (#526)
  • cdad80a chore(deps-dev): bump jest from 30.1.3 to 30.2.0 (#525)
  • 45eec0d chore(deps-dev): bump lint-staged from 16.2.1 to 16.2.4 (#528)
  • a20799d chore(deps): bump actions/setup-node from 5.0.0 to 6.0.0 (#529)
  • 56e320f chore(deps-dev): bump @​vercel/ncc from 0.38.3 to 0.38.4 (#517)
  • 05c485f chore(deps-dev): bump eslint from 9.35.0 to 9.36.0 (#519)
  • 0c215f8 chore(deps-dev): bump tar from 7.4.3 to 7.5.1 (#521)
  • Additional commits viewable in compare view

Updates github/codeql-action from 3.28.15 to 4.30.8

Release notes

Sourced from github/codeql-action's releases.

v4.30.8

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.8 - 10 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v4.30.7

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.7 - 06 Oct 2025

  • [v4+ only] The CodeQL Action now runs on Node.js v24. #3169

See the full CHANGELOG.md for more information.

v3.30.8

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.8 - 10 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.30.7

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.7 - 06 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.30.6

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.6 - 02 Oct 2025

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

  • Update default CodeQL bundle version to 2.23.3. #3205
  • Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #3204

4.30.8 - 10 Oct 2025

No user facing changes.

4.30.7 - 06 Oct 2025

  • [v4+ only] The CodeQL Action now runs on Node.js v24. #3169

3.30.6 - 02 Oct 2025

  • Update default CodeQL bundle version to 2.23.2. #3168

3.30.5 - 26 Sep 2025

  • We fixed a bug that was introduced in 3.30.4 with upload-sarif which resulted in files without a .sarif extension not getting uploaded. #3160

3.30.4 - 25 Sep 2025

  • We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the codeql-action/init step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the codeql-action/init step. #3099 and #3100
  • We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. #3107
  • You can now run the latest CodeQL nightly bundle by passing tools: nightly to the init action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. #3130
  • Update default CodeQL bundle version to 2.23.1. #3118

3.30.3 - 10 Sep 2025

No user facing changes.

3.30.2 - 09 Sep 2025

  • Fixed a bug which could cause language autodetection to fail. #3084
  • Experimental: The quality-queries input that was added in 3.29.2 as part of an internal experiment is now deprecated and will be removed in an upcoming version of the CodeQL Action. It has been superseded by a new analysis-kinds input, which is part of the same internal experiment. Do not use this in production as it is subject to change at any time. #3064

3.30.1 - 05 Sep 2025

  • Update default CodeQL bundle version to 2.23.0. #3077

3.30.0 - 01 Sep 2025

  • Reduce the size of the CodeQL Action, speeding up workflows by approximately 4 seconds. #3054

3.29.11 - 21 Aug 2025

... (truncated)

Commits
  • f443b60 Merge pull request #3198 from github/update-v4.30.8-527f0f324
  • 7a2cb62 Update changelog for v4.30.8
  • 527f0f3 Merge pull request #3195 from github/dependabot/npm_and_yarn/npm-minor-37415c...
  • f402506 Merge pull request #3196 from github/dependabot/github_actions/dot-github/wor...
  • f5e53f9 Merge pull request #3197 from github/dependabot/github_actions/dot-github/wor...
  • 4e90a42 Merge pull request #3193 from github/mbg/ff/tools-toolcache
  • 413a4a4 Rebuild
  • 4521864 Bump github/codeql-action from 3 to 4 in /.github/workflows
  • eadf14b Bump ruby/setup-ruby
  • e1257b6 Rebuild
  • Additional commits viewable in compare view

Updates actions/download-artifact from 4.3.0 to 5.0.0

Release notes

Sourced from actions/download-artifact's releases.

v5.0.0

What's Changed

v5.0.0

🚨 Breaking Change

This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.

What Changed

Previously, single artifact downloads behaved differently depending on how you specified the artifact:

  • By name: name: my-artifact → extracted to path/ (direct)
  • By ID: artifact-ids: 12345 → extracted to path/my-artifact/ (nested)

Now both methods are consistent:

  • By name: name: my-artifact → extracted to path/ (unchanged)
  • By ID: artifact-ids: 12345 → extracted to path/ (fixed - now direct)

Migration Guide

✅ No Action Needed If:
  • You download artifacts by name
  • You download multiple artifacts by ID
  • You already use merge-multiple: true as a workaround
⚠️ Action Required If:

You download single artifacts by ID and your workflows expect the nested directory structure.

Before v5 (nested structure):

- uses: actions/download-artifact@v4
  with:
    artifact-ids: 12345
    path: dist
# Files were in: dist/my-artifact/

Where my-artifact is the name of the artifact you previously uploaded

To maintain old behavior (if needed):

</tr></table>

... (truncated)

Commits
  • 634f93c Merge pull request #416 from actions/single-artifact-id-download-path
  • b19ff43 refactor: resolve download path correctly in artifact download tests (mainly ...
  • e262cbe bundle dist
  • bff23f9 update docs
  • fff8c14 fix download path logic when downloading a single artifact by id
  • 448e3f8 Merge pull request #407 from actions/nebuk89-patch-1
  • 47225c4 Update README.md
  • See full diff in compare view

Updates softprops/action-gh-release from 97d42c1b50f585f357413698aa1b779307aa0d52 to 5434409c2b6457c050f109d68b2547fcbf1db07b

Changelog

Sourced from softprops/action-gh-release's changelog.

2.4.1

What's Changed

Other Changes 🔄

2.4.0

What's Changed

Exciting New Features 🎉

2.3.4

What's Changed

Bug fixes 🐛

Other Changes 🔄

  • dependency updates

2.3.3

What's Changed

Exciting New Features 🎉

Other Changes 🔄

  • dependency updates

2.3.2

  • fix: revert fs readableWebStream change

2.3.1

Bug fixes 🐛

... (truncated)

Commits
  • 5434409 chore(deps): bump @​types/node from 20.19.19 to 20.19.21 in the npm group (#679)
  • 6da8fa9 release 2.4.1
  • f38efde fix: gracefully fallback to body when body_path cannot be read (#671)
  • cec1a11 fix(util): support brace expansion globs containing commas in parseInputFiles...
  • aec2ec5 release 2.4.0
  • 4db716b feat: respect working_directory for files globs; add input and tests (#667)
  • 14820f2 chore(deps): bump the npm group with 2 updates (#668)
  • 62c96d0 release 2.3.4
  • 7dc9b8a fix(action): handle 422 already_exists race condition (#665)
  • 0f0e0b9 chore(deps): bump the npm group with 3 updates (#666)
  • See full diff in compare view

Updates docker/metadata-action from 5.7.0 to 5.8.0

Release notes

Sourced from docker/metadata-action's releases.

v5.8.0

Full Changelog: docker/metadata-action@v5.7.0...v5.8.0

Commits
  • c1e5197 Merge pull request #537 from crazy-max/pep440-match
  • 89dd65a chore: update generated content
  • 699ee45 allow to match part of the git tag or value for pep440 type
  • e0542a6 Merge pull request #536 from crazy-max/semver-match

@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 17, 2025
@dependabot dependabot bot requested a review from a team as a code owner October 17, 2025 14:14
@dependabot dependabot bot added github_actions Pull requests that update GitHub Actions code dependencies Pull requests that update a dependency file labels Oct 17, 2025
@coderabbitai
Copy link

coderabbitai bot commented Oct 17, 2025

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Comment @coderabbitai help to get the list of available commands and usage tips.

@dependabot
chore(deps): bump the actions-deps group with 15 updates
f9dc69f 
Bumps the actions-deps group with 15 updates:

| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.13.0` | `2.13.1` |
| [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `5.0.0` |
| [tj-actions/changed-files](https://github.com/tj-actions/changed-files) | `212f9a7760ad2b8eb511185b841f3725a62c2ae0` | `d03a93c0dbfac6d6dd6a0d8a5e7daff992b07449` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.4.3` | `5.5.1` |
| [anchore/scan-action](https://github.com/anchore/scan-action) | `7.0.0` | `7.0.2` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3.28.15` | `4.30.8` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `5.0.0` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `97d42c1b50f585f357413698aa1b779307aa0d52` | `5434409c2b6457c050f109d68b2547fcbf1db07b` |
| [docker/metadata-action](https://github.com/docker/metadata-action) | `5.7.0` | `5.8.0` |
| [docker/login-action](https://github.com/docker/login-action) | `3.4.0` | `3.6.0` |
| [peter-evans/dockerhub-description](https://github.com/peter-evans/dockerhub-description) | `a701644270a123c7b02b318a8e4fe71e15a8f3cb` | `31b7155ea9926ec41d93d6c52a18d3022bfd128a` |
| [googleapis/release-please-action](https://github.com/googleapis/release-please-action) | `4.2.0` | `4.3.0` |
| [iarekylew00t/verified-bot-commit](https://github.com/iarekylew00t/verified-bot-commit) | `1.5.2` | `2.0.3` |
| [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.20.6` | `0.20.8` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.1` | `2.4.3` |


Updates `step-security/harden-runner` from 2.13.0 to 2.13.1
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@ec9f2d5...f4a75cf)

Updates `actions/checkout` from 4.2.2 to 5.0.0
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11bd719...08c6903)

Updates `tj-actions/changed-files` from 212f9a7760ad2b8eb511185b841f3725a62c2ae0 to d03a93c0dbfac6d6dd6a0d8a5e7daff992b07449
- [Release notes](https://github.com/tj-actions/changed-files/releases)
- [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md)
- [Commits](tj-actions/changed-files@212f9a7...d03a93c)

Updates `codecov/codecov-action` from 5.4.3 to 5.5.1
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@18283e0...5a10915)

Updates `anchore/scan-action` from 7.0.0 to 7.0.2
- [Release notes](https://github.com/anchore/scan-action/releases)
- [Changelog](https://github.com/anchore/scan-action/blob/main/RELEASE.md)
- [Commits](anchore/scan-action@f660128...a5605eb)

Updates `github/codeql-action` from 3.28.15 to 4.30.8
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v3.28.15...f443b60)

Updates `actions/download-artifact` from 4.3.0 to 5.0.0
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@d3f86a1...634f93c)

Updates `softprops/action-gh-release` from 97d42c1b50f585f357413698aa1b779307aa0d52 to 5434409c2b6457c050f109d68b2547fcbf1db07b
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@97d42c1...5434409)

Updates `docker/metadata-action` from 5.7.0 to 5.8.0
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@902fa8e...c1e5197)

Updates `docker/login-action` from 3.4.0 to 3.6.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@74a5d14...5e57cd1)

Updates `peter-evans/dockerhub-description` from a701644270a123c7b02b318a8e4fe71e15a8f3cb to 31b7155ea9926ec41d93d6c52a18d3022bfd128a
- [Release notes](https://github.com/peter-evans/dockerhub-description/releases)
- [Commits](peter-evans/dockerhub-description@a701644...31b7155)

Updates `googleapis/release-please-action` from 4.2.0 to 4.3.0
- [Release notes](https://github.com/googleapis/release-please-action/releases)
- [Changelog](https://github.com/googleapis/release-please-action/blob/main/CHANGELOG.md)
- [Commits](googleapis/release-please-action@a02a34c...c2a5a2b)

Updates `iarekylew00t/verified-bot-commit` from 1.5.2 to 2.0.3
- [Release notes](https://github.com/iarekylew00t/verified-bot-commit/releases)
- [Commits](IAreKyleW00t/verified-bot-commit@cd576ea...400b5d3)

Updates `anchore/sbom-action` from 0.20.6 to 0.20.8
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@f8bdd1d...aa0e114)

Updates `ossf/scorecard-action` from 2.4.1 to 2.4.3
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@f49aabe...4eaacf0)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.13.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-deps
- dependency-name: actions/checkout
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-deps
- dependency-name: tj-actions/changed-files
  dependency-version: d03a93c0dbfac6d6dd6a0d8a5e7daff992b07449
  dependency-type: direct:production
  dependency-group: actions-deps
- dependency-name: codecov/codecov-action
  dependency-version: 5.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-deps
- dependency-name: anchore/scan-action
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-deps
- dependency-name: github/codeql-action
  dependency-version: 4.30.8
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-deps
- dependency-name: actions/download-artifact
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-deps
- dependency-name: softprops/action-gh-release
  dependency-version: 5434409c2b6457c050f109d68b2547fcbf1db07b
  dependency-type: direct:production
  dependency-group: actions-deps
- dependency-name: docker/metadata-action
  dependency-version: 5.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-deps
- dependency-name: docker/login-action
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-deps
- dependency-name: peter-evans/dockerhub-description
  dependency-version: 31b7155ea9926ec41d93d6c52a18d3022bfd128a
  dependency-type: direct:production
  dependency-group: actions-deps
- dependency-name: googleapis/release-please-action
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-deps
- dependency-name: iarekylew00t/verified-bot-commit
  dependency-version: 2.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-deps
- dependency-name: anchore/sbom-action
  dependency-version: 0.20.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-deps
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-deps
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/github_actions/actions-deps-eacc6fdae8 branch from 04018a9 to f9dc69f Compare October 20, 2025 22:55
@son-oz
Copy link
Contributor

son-oz commented Oct 21, 2025

Let's wait for a few more days on this. I'm changing the dependabot configuration to add a delay for this type of updates in case if there is a supply chain issue.

@son-oz
Copy link
Contributor

son-oz commented Oct 28, 2025

@dependabot rebase

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Oct 28, 2025

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Oct 28, 2025
@dependabot dependabot bot deleted the dependabot/github_actions/actions-deps-eacc6fdae8 branch October 28, 2025 16:18
@github-actions github-actions bot locked and limited conversation to collaborators Oct 28, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

cla: allowlist cla: signed dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@son-oz