Skip to content

chore(deps): bump the github-action-dependencies group across 1 directory with 11 updates #1792

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump the github-action-dependencies group across 1 directory with 11 updates #1792

dependabot wants to merge 1 commit into from
+35 −35

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 18, 2025 •
edited
Loading

Bumps the github-action-dependencies group with 11 updates in the / directory:

Package From To
step-security/harden-runner 2.13.2 2.14.0
actions/checkout 5.0.0 6.0.1
elgohr/Publish-Docker-Github-Action 1d95820b6952cab6e48a2454ff6ca9804bf65f31 91c436a78cf9a03eab9a942f18afc723a96db263
aws-actions/configure-aws-credentials 5.1.0 5.1.1
golangci/golangci-lint-action 8.0.0 9.2.0
actions/setup-node 6.0.0 6.1.0
svenstaro/upload-release-action 2.11.2 2.11.3
mikefarah/yq 4.48.1 4.50.1
stefanzweifel/git-auto-commit-action 7.0.0 7.1.0
actions/upload-artifact 5.0.0 6.0.0
github/codeql-action 4.31.2 4.31.9

Updates step-security/harden-runner from 2.13.2 to 2.14.0

Release notes

Sourced from step-security/harden-runner's releases.

v2.14.0

What's Changed

  • Selective installation: Harden-Runner now skips installation on GitHub-hosted runners when the repository has a custom property skip_harden_runner, allowing organizations to opt out specific repos.
  • Avoid double install: The action no longer installs Harden-Runner if it’s already present on a GitHub-hosted runner, which could happen when a composite action also installs it.

Full Changelog: step-security/harden-runner@v2.13.3...v2.14.0

v2.13.3

What's Changed

  • Fixed an issue where process events were not uploaded in certain edge cases.

Full Changelog: step-security/harden-runner@v2.13.2...v2.13.3

Commits
  • 20cf305 Merge pull request #622 from step-security/feature/custom-property-skip
  • c51e8ee feat: skip agent install and post step on subsequent runs for GitHub-hosted r...
  • e152b90 feat: skip harden-runner based on repository custom property
  • ee1faec feat: replace skip-harden-runner with skip-on-custom-property input
  • 1dc7c17 feat: add skip-harden-runner input to conditionally skip execution
  • df199fb Merge pull request #620 from step-security/rc-29
  • 03d096a update agent
  • 4090107 fix: update agent
  • See full diff in compare view

Updates actions/checkout from 5.0.0 to 6.0.1

Release notes

Sourced from actions/checkout's releases.

v6.0.1

What's Changed

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Full Changelog: actions/checkout@v5...v5.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v4.1.5

... (truncated)

Commits

Updates elgohr/Publish-Docker-Github-Action from 1d95820b6952cab6e48a2454ff6ca9804bf65f31 to 91c436a78cf9a03eab9a942f18afc723a96db263

Commits
  • 91c436a Merge pull request #233 from elgohr/dependabot/github_actions/actions/checkout-6
  • 796892e Bump actions/checkout from 5 to 6
  • 15cc35e Merge pull request #232 from elgohr/dependabot/docker/ubuntu-c35e29c
  • 2017e76 Bump ubuntu from e96e81f to c35e29c
  • 30b5fbd Merge pull request #231 from elgohr/dependabot/docker/ubuntu-e96e81f
  • 097f2e7 Bump ubuntu from 66460d5 to e96e81f
  • See full diff in compare view

Updates aws-actions/configure-aws-credentials from 5.1.0 to 5.1.1

Release notes

Sourced from aws-actions/configure-aws-credentials's releases.

v5.1.1

5.1.1 (2025-11-24)

Miscellaneous Chores

  • release 5.1.1 (56d6a58)
  • various dependency updates
Changelog

Sourced from aws-actions/configure-aws-credentials's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

5.1.1 (2025-11-24)

Miscellaneous Chores

5.1.0 (2025-10-06)

Features

Bug Fixes

5.0.0 (2025-09-03)

⚠ BREAKING CHANGES

  • Cleanup input handling. Changes invalid boolean input behavior (see #1445)

Features

4.3.1 (2025-08-04)

Bug Fixes

4.3.0 (2025-08-04)

Features

... (truncated)

Commits
  • 61815dc chore(main): release 5.1.1 (#1564)
  • 56d6a58 chore: release 5.1.1
  • 4a54c24 chore(deps-dev): bump glob from 10.4.5 to 10.5.0 (#1563)
  • b2793c9 chore(deps-dev): bump @​types/node from 24.10.0 to 24.10.1 (#1559)
  • 8c230bf chore: Update dist
  • f7a5b07 chore(deps): bump @​aws-sdk/client-sts from 3.928.0 to 3.933.0 (#1558)
  • 730fc04 chore(deps-dev): bump @​biomejs/biome from 2.3.4 to 2.3.6 (#1555)
  • bc0dd36 chore(deps-dev): bump memfs from 4.50.0 to 4.51.0 (#1556)
  • f2964c7 chore: Update dist
  • cf46495 chore(deps): bump @​aws-sdk/client-sts from 3.922.0 to 3.928.0 (#1548)
  • Additional commits viewable in compare view

Updates golangci/golangci-lint-action from 8.0.0 to 9.2.0

Release notes

Sourced from golangci/golangci-lint-action's releases.

v9.2.0

What's Changed

Changes

Dependencies

Full Changelog: golangci/golangci-lint-action@v9.1.0...v9.2.0

v9.1.0

What's Changed

Changes

Documentation

Dependencies

Full Changelog: golangci/golangci-lint-action@v9.0.0...v9.1.0

v9.0.0

In the scope of this release, we change Nodejs runtime from node20 to node24 (https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/).

What's Changed

Changes

Full Changelog: golangci/golangci-lint-action@v8.0.0...v9.0.0

Commits

Updates actions/setup-node from 6.0.0 to 6.1.0

Release notes

Sourced from actions/setup-node's releases.

v6.1.0

What's Changed

Enhancement:

Dependency updates:

Documentation update:

Full Changelog: actions/setup-node@v6...v6.1.0

Commits

Updates svenstaro/upload-release-action from 2.11.2 to 2.11.3

Release notes

Sourced from svenstaro/upload-release-action's releases.

2.11.3

Post-fix Github errors - releases created as draft when they shouldn't have been - #99

Changelog

Sourced from svenstaro/upload-release-action's changelog.

Changelog

[2.11.3] - 2025-11-20

  • Post-fix releases created as draft when they shouldn't have - #99

[2.11.2] - 2025-07-06

  • Solved race-condition when matrix builds try to create the same release at the same time - #147

[2.11.1] - 2025-06-30

  • Adds a release_id output, and optional input, for uploading files to release - #136 (thanks @​alexis-opolka)

[2.10.0] - 2025-06-21

  • Adds the ability to disable duplicate check, for lower Github API usage - #142 (thanks @​colinsullivan)

[2.9.1] - 2025-06-21

  • Fixed development + CI, updated dependencies #137

[2.9.0] - 2024-02-22

[2.8.0] - 2024-02-21

  • Bump all deps
  • Update to node 20

[2.7.0] - 2023-07-28

[2.6.1] - 2023-05-31

[2.6.0] - 2023-05-23

  • Add make_latest input parameter. Can be set to false to prevent the created release from being marked as the latest release for the repository #100 (thanks @​brandonkelly)
  • Don't try to upload empty files #102 (thanks @​Loyalsoldier)
  • Bump all deps #105
  • overwrite option also overwrites name and body #106 (thanks @​regevbr)
  • Add promote option to allow prereleases to be promoted #74 (thanks @​regevbr)

[2.5.0] - 2023-02-21

[2.4.1] - 2023-02-01

  • Modernize octokit usage

[2.4.0] - 2023-01-09

  • Update to node 16
  • Bump most dependencies

[2.3.0] - 2022-06-05

  • Now defaults repo_token to ${{ github.token }} and tag to ${{ github.ref }} #69 (thanks @​leighmcculloch)

... (truncated)

Commits

Updates mikefarah/yq from 4.48.1 to 4.50.1

Release notes

Sourced from mikefarah/yq's releases.

v4.50.1 - HCL!

  • Added HCL Support - First cut - hopefully it works well! (#1844)
  • Fixing handling of CRLF #2352
  • Bumped dependencies

v4.49.2

v4.49.1 - Security Flags and TOML fixes

  • Added --security flags to disable env and file ops #2515
  • Fixing TOML ArrayTable parsing issues #1758
  • Fixing parsing of escaped characters #2506

v4.48.2

Changelog

Sourced from mikefarah/yq's changelog.

4.50.1:

  • Added HCL support!
  • Fixing handling of CRLF #2352
  • Bumped dependencies

4.49.2:

4.49.1:

  • Added --security flags to disable env and file ops #2515
  • Fixing TOML ArrayTable parsing issues #1758
  • Fixing parsing of escaped characters #2506

4.48.2:

4.48.1:

  • Added 'parents' operator, to return a list of all the hierarchical parents of a node
  • Added 'first(exp)' operator, to return the first entry matching an expression in an array
  • Fixed xml namespace prefixes #1730 (thanks @​baodrate)
  • Fixed out of range panic in yaml decoder #2460 (thanks @​n471d)
  • Bumped dependencies

4.47.2:

4.47.1:

  • Fixed merge anchor behaviour (<<); #2404, #2110, #2386, #2178 Huge thanks to @​stevenwdv! Note that you will need to set --yaml-fix-merge-anchor-to-spec to see the fixes
  • Fixed panic for syntax error when creating a map #2423
  • Bumped dependencies

4.46.1:

  • Added INI support
  • Fixed 'add' operator when piped in with no data #2378, #2383, #2384
  • Fixed delete after slice problem (bad node path) #2387 Thanks @​antoinedeschenes
  • Fixed yq small build Thanks @​imzue
  • Switched to YAML org supported go-yaml!
  • Bumped dependencies

4.45.4:

  • Fixing wrong map() behaviour on empty map #2359

... (truncated)

Commits
  • 065b200 Bumping version
  • 745a7ff Preparing release
  • a305d70 Bump golang.org/x/net from 0.47.0 to 0.48.0
  • 0671ccd Bump github.com/zclconf/go-cty from 1.16.3 to 1.17.0
  • 4d8cd45 Bump golang.org/x/text from 0.31.0 to 0.32.0
  • d2d657e HCL improvements
  • f4fd8c5 Better roundtriping of HCL
  • e4bf8a1 Simplifying HCL decoder
  • fd40574 Add build tag to hcl_test.go to skip tests when HCL is disabled
  • 51ddf8d Update pkg/yqlib/format.go
  • Additional commits viewable in compare view

Updates stefanzweifel/git-auto-commit-action from 7.0.0 to 7.1.0

Release notes

Sourced from stefanzweifel/git-auto-commit-action's releases.

v7.1.0

Added

Changes

Dependency Updates

Changelog

Sourced from stefanzweifel/git-auto-commit-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Unreleased

TBD

v7.1.0 - 2025-12-17

Added

Changes

Dependency Updates

v7.0.0 - 2025-10-12

Added

Changed

Dependency Updates

v6.0.1 - 2025-06-11

Fixed

v6.0.0 - 2025-06-10

... (truncated)

Commits

Updates actions/upload-artifact from 5.0.0 to 6.0.0

Release notes

Sourced from actions/upload-artifact's releases.

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

Commits
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • ddc45ed docs: update README to correct action name for Node.js 24 support
  • 615b319 chore: release v6.0.0 for Node.js 24 support
  • 017748b Merge pull request #744 from actions/fix-storage-blob
  • 38d4c79 chore: rebuild dist
  • 7d27270 chore: add missing license cache files for @​actions/core, @​actions/io, and mi...
  • 5f643d3 chore: update license files for @​actions/artifact@​5.0.1 dependencies
  • 1df1684 chore: update package-lock.json with @​actions/artifact@​5.0.1
  • b5b1a91 fix: update @​actions/artifact to ^5.0.0 for Node.js 24 punycode fix
  • Additional commits viewable in compare view

Updates github/codeql-action from 4.31.2 to 4.31.9

Release notes

Sourced from github/codeql-action's releases.

v4.31.9

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.9 - 16 Dec 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v4.31.8

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.8 - 11 Dec 2025

  • Update default CodeQL bundle version to 2.23.8. #3354

See the full CHANGELOG.md for more information.

v4.31.7

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.7 - 05 Dec 2025

  • Update default CodeQL bundle version to 2.23.7. #3343

See the full CHANGELOG.md for more information.

v4.31.6

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.6 - 01 Dec 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v4.31.5

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.5 - 24 Nov 2025

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.31.9 - 16 Dec 2025

No user facing changes.

4.31.8 - 11 Dec 2025

  • Update default CodeQL bundle version to 2.23.8. #3354

4.31.7 - 05 Dec 2025

  • Update default CodeQL bundle version to 2.23.7. #3343

4.31.6 - 01 Dec 2025

No user facing changes.

4.31.5 - 24 Nov 2025

  • Update default CodeQL bundle version to 2.23.6. #3321

4.31.4 - 18 Nov 2025

No user facing changes.

4.31.3 - 13 Nov 2025

  • CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers w...

    Description has been truncated

@dependabot
chore(deps): bump the github-action-dependencies group across 1 direc…
1f53428 
…tory with 11 updates

Bumps the github-action-dependencies group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.13.2` | `2.14.0` |
| [actions/checkout](https://github.com/actions/checkout) | `5.0.0` | `6.0.1` |
| [elgohr/Publish-Docker-Github-Action](https://github.com/elgohr/publish-docker-github-action) | `1d95820b6952cab6e48a2454ff6ca9804bf65f31` | `91c436a78cf9a03eab9a942f18afc723a96db263` |
| [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `5.1.0` | `5.1.1` |
| [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `8.0.0` | `9.2.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.0.0` | `6.1.0` |
| [svenstaro/upload-release-action](https://github.com/svenstaro/upload-release-action) | `2.11.2` | `2.11.3` |
| [mikefarah/yq](https://github.com/mikefarah/yq) | `4.48.1` | `4.50.1` |
| [stefanzweifel/git-auto-commit-action](https://github.com/stefanzweifel/git-auto-commit-action) | `7.0.0` | `7.1.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `5.0.0` | `6.0.0` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.31.2` | `4.31.9` |



Updates `step-security/harden-runner` from 2.13.2 to 2.14.0
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@95d9a5d...20cf305)

Updates `actions/checkout` from 5.0.0 to 6.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@08c6903...8e8c483)

Updates `elgohr/Publish-Docker-Github-Action` from 1d95820b6952cab6e48a2454ff6ca9804bf65f31 to 91c436a78cf9a03eab9a942f18afc723a96db263
- [Release notes](https://github.com/elgohr/publish-docker-github-action/releases)
- [Commits](elgohr/Publish-Docker-Github-Action@1d95820...91c436a)

Updates `aws-actions/configure-aws-credentials` from 5.1.0 to 5.1.1
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](aws-actions/configure-aws-credentials@0094301...61815dc)

Updates `golangci/golangci-lint-action` from 8.0.0 to 9.2.0
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](golangci/golangci-lint-action@4afd733...1e7e51e)

Updates `actions/setup-node` from 6.0.0 to 6.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@2028fbc...395ad32)

Updates `svenstaro/upload-release-action` from 2.11.2 to 2.11.3
- [Release notes](https://github.com/svenstaro/upload-release-action/releases)
- [Changelog](https://github.com/svenstaro/upload-release-action/blob/master/CHANGELOG.md)
- [Commits](svenstaro/upload-release-action@81c65b7...6b7fa9f)

Updates `mikefarah/yq` from 4.48.1 to 4.50.1
- [Release notes](https://github.com/mikefarah/yq/releases)
- [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt)
- [Commits](mikefarah/yq@0ecdce2...065b200)

Updates `stefanzweifel/git-auto-commit-action` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/stefanzweifel/git-auto-commit-action/releases)
- [Changelog](https://github.com/stefanzweifel/git-auto-commit-action/blob/master/CHANGELOG.md)
- [Commits](stefanzweifel/git-auto-commit-action@28e16e8...04702ed)

Updates `actions/upload-artifact` from 5.0.0 to 6.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@330a01c...b7c566a)

Updates `github/codeql-action` from 4.31.2 to 4.31.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@0499de3...5d4e8d1)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-action-dependencies
- dependency-name: actions/checkout
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-action-dependencies
- dependency-name: elgohr/Publish-Docker-Github-Action
  dependency-version: 91c436a78cf9a03eab9a942f18afc723a96db263
  dependency-type: direct:production
  dependency-group: github-action-dependencies
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: 5.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-action-dependencies
- dependency-name: golangci/golangci-lint-action
  dependency-version: 9.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-action-dependencies
- dependency-name: actions/setup-node
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-action-dependencies
- dependency-name: svenstaro/upload-release-action
  dependency-version: 2.11.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-action-dependencies
- dependency-name: mikefarah/yq
  dependency-version: 4.50.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-action-dependencies
- dependency-name: stefanzweifel/git-auto-commit-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-action-dependencies
- dependency-name: actions/upload-artifact
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-action-dependencies
- dependency-name: github/codeql-action
  dependency-version: 4.31.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-action-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies github_actions Pull requests that update GitHub Actions code labels Dec 18, 2025
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Dec 18, 2025

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Comment @coderabbitai help to get the list of available commands and usage tips.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant