build(deps): bump the github-actions group with 5 updates #1707

dependabot · 2025-01-01T09:22:52Z

Bumps the github-actions group with 5 updates:

Package	From	To
github/codeql-action	`3.27.5`	`3.28.0`
dagger/dagger-for-github	`7.0.1`	`7.0.3`
actions/setup-go	`5.1.0`	`5.2.0`
actions/upload-artifact	`4.4.3`	`4.5.0`
peter-evans/create-pull-request	`7.0.5`	`7.0.6`

Updates github/codeql-action from 3.27.5 to 3.28.0

Release notes

Sourced from github/codeql-action's releases.

v3.28.0

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.28.0 - 20 Dec 2024

Bump the minimum CodeQL bundle version to 2.15.5. #2655

Don't fail in the unusual case that a file is on the search path. #2660.

See the full CHANGELOG.md for more information.

v3.27.9

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.9 - 12 Dec 2024

No user facing changes.

See the full CHANGELOG.md for more information.

v3.27.7

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.7 - 10 Dec 2024

We are rolling out a change in December 2024 that will extract the CodeQL bundle directly to the toolcache to improve performance. #2631

Update default CodeQL bundle version to 2.20.0. #2636

See the full CHANGELOG.md for more information.

v3.27.6

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.6 - 03 Dec 2024

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

[UNRELEASED]

No user facing changes.

3.28.0 - 20 Dec 2024

Bump the minimum CodeQL bundle version to 2.15.5. #2655

Don't fail in the unusual case that a file is on the search path. #2660.

3.27.9 - 12 Dec 2024

No user facing changes.

3.27.8 - 12 Dec 2024

Fixed an issue where streaming the download and extraction of the CodeQL bundle did not respect proxy settings. #2624

3.27.7 - 10 Dec 2024

We are rolling out a change in December 2024 that will extract the CodeQL bundle directly to the toolcache to improve performance. #2631

Update default CodeQL bundle version to 2.20.0. #2636

3.27.6 - 03 Dec 2024

Update default CodeQL bundle version to 2.19.4. #2626

3.27.5 - 19 Nov 2024

No user facing changes.

3.27.4 - 14 Nov 2024

No user facing changes.

3.27.3 - 12 Nov 2024

No user facing changes.

3.27.2 - 12 Nov 2024

Fixed an issue where setting up the CodeQL tools would sometimes fail with the message "Invalid value 'undefined' for header 'authorization'". #2590

3.27.1 - 08 Nov 2024

... (truncated)

Commits

48ab28a Merge pull request #2662 from github/update-v3.28.0-d01b25e64
4946b76 Update changelog for v3.28.0
d01b25e Merge pull request #2660 from github/henrymercer/fix-error-file-on-path
7d6d36c Add changelog note
b58f447 Use @actions/io to locate binaries
64cc90b Merge pull request #2653 from github/dependabot/npm_and_yarn/npm-61c837125e
d8f8eca Merge branch 'main' into dependabot/npm_and_yarn/npm-61c837125e
562042d Merge pull request #2655 from github/aeisenberg/deprecate-2.14
beed6ff Change codeql version used in test
5f0a4d3 Bump the minimum supported version of CodeQL to 2.15.5
Additional commits viewable in compare view

Updates dagger/dagger-for-github from 7.0.1 to 7.0.3

Release notes

Sourced from dagger/dagger-for-github's releases.

v7.0.3

Full Changelog: dagger/dagger-for-github@v7...v7.0.3

v7.0.2

What's Changed

chore: bump default dagger version to v0.15.0 by @jedevc in dagger/dagger-for-github#165

Full Changelog: dagger/dagger-for-github@v7...v7.0.2

Commits

847ae44 chore: bump default dagger version to v0.15.1
2f17ffe chore: bump default dagger version to v0.15.0 (#165)
See full diff in compare view

Updates actions/setup-go from 5.1.0 to 5.2.0

Release notes

Sourced from actions/setup-go's releases.

v5.2.0

What's Changed

Leveraging the raw API to retrieve the version-manifest, as it does not impose a rate limit and hence facilitates unrestricted consumption without the need for a token for Github Enterprise Servers by @Shegox in actions/setup-go#496

New Contributors

@Shegox made their first contribution in actions/setup-go#496

Full Changelog: actions/setup-go@v5...v5.2.0

Commits

3041bf5 feat: fallback to "raw" endpoint for manifest when rate limit is reached (#496)
See full diff in compare view

Updates actions/upload-artifact from 4.4.3 to 4.5.0

Release notes

Sourced from actions/upload-artifact's releases.

v4.5.0

What's Changed

fix: deprecated Node.js version in action by @hamirmahal in actions/upload-artifact#578

Add new artifact-digest output by @bdehamer in actions/upload-artifact#656

New Contributors

@hamirmahal made their first contribution in actions/upload-artifact#578

@bdehamer made their first contribution in actions/upload-artifact#656

Full Changelog: actions/upload-artifact@v4.4.3...v4.5.0

Commits

6f51ac0 Merge pull request #656 from bdehamer/bdehamer/artifact-digest
c40c16d add new artifact-digest output
735efb4 bump @actions/artifact from 2.1.11 to 2.2.0
184d73b Merge pull request #578 from hamirmahal/fix/deprecated-nodejs-usage-in-action
b4a0a98 Merge branch 'main' into fix/deprecated-nodejs-usage-in-action
See full diff in compare view

Updates peter-evans/create-pull-request from 7.0.5 to 7.0.6

Release notes

Sourced from peter-evans/create-pull-request's releases.

Create Pull Request v7.0.6

⚙️ Fixes an issue with commit signing where unicode characters in file paths were not preserved.

What's Changed

build(deps-dev): bump @vercel/ncc from 0.38.1 to 0.38.2 by @dependabot in peter-evans/create-pull-request#3365

Update distribution by @actions-bot in peter-evans/create-pull-request#3370

build(deps): bump @octokit/plugin-rest-endpoint-methods from 13.2.4 to 13.2.5 by @dependabot in peter-evans/create-pull-request#3375

build(deps-dev): bump @types/node from 18.19.50 to 18.19.54 by @dependabot in peter-evans/create-pull-request#3376

build(deps): bump @octokit/plugin-paginate-rest from 11.3.3 to 11.3.5 by @dependabot in peter-evans/create-pull-request#3377

Update distribution by @actions-bot in peter-evans/create-pull-request#3388

build(deps-dev): bump @types/node from 18.19.54 to 18.19.55 by @dependabot in peter-evans/create-pull-request#3400

build(deps): bump @actions/core from 1.10.1 to 1.11.1 by @dependabot in peter-evans/create-pull-request#3401

build(deps): bump @octokit/plugin-rest-endpoint-methods from 13.2.5 to 13.2.6 by @dependabot in peter-evans/create-pull-request#3403

build(deps-dev): bump eslint-plugin-import from 2.30.0 to 2.31.0 by @dependabot in peter-evans/create-pull-request#3402

build(deps): bump @octokit/plugin-throttling from 9.3.1 to 9.3.2 by @dependabot in peter-evans/create-pull-request#3404

Update distribution by @actions-bot in peter-evans/create-pull-request#3423

build(deps-dev): bump typescript from 5.6.2 to 5.6.3 by @dependabot in peter-evans/create-pull-request#3441

build(deps): bump undici from 6.19.8 to 6.20.1 by @dependabot in peter-evans/create-pull-request#3442

Update distribution by @actions-bot in peter-evans/create-pull-request#3451

build(deps-dev): bump @types/node from 18.19.55 to 18.19.58 by @dependabot in peter-evans/create-pull-request#3457

build(deps-dev): bump @types/jest from 29.5.13 to 29.5.14 by @dependabot in peter-evans/create-pull-request#3462

build(deps-dev): bump @types/node from 18.19.58 to 18.19.60 by @dependabot in peter-evans/create-pull-request#3463

chore: don't bundle undici by @benmccann in peter-evans/create-pull-request#3475

Update distribution by @actions-bot in peter-evans/create-pull-request#3478

chore: use node-fetch-native support for proxy env vars by @peter-evans in peter-evans/create-pull-request#3483

build(deps-dev): bump @types/node from 18.19.60 to 18.19.64 by @dependabot in peter-evans/create-pull-request#3488

build(deps-dev): bump undici from 6.20.1 to 6.21.0 by @dependabot in peter-evans/create-pull-request#3499

build(deps-dev): bump @vercel/ncc from 0.38.2 to 0.38.3 by @dependabot in peter-evans/create-pull-request#3500

docs: note push-to-repo classic PAT workflow scope requirement by @scop in peter-evans/create-pull-request#3511

docs: spelling fixes by @scop in peter-evans/create-pull-request#3512

build(deps-dev): bump typescript from 5.6.3 to 5.7.2 by @dependabot in peter-evans/create-pull-request#3516

build(deps-dev): bump prettier from 3.3.3 to 3.4.0 by @dependabot in peter-evans/create-pull-request#3517

build(deps-dev): bump @types/node from 18.19.64 to 18.19.66 by @dependabot in peter-evans/create-pull-request#3518

docs(README): clarify that an existing open PR is managed by @caugner in peter-evans/create-pull-request#3498

Update distribution by @actions-bot in peter-evans/create-pull-request#3529

build(deps): bump @octokit/plugin-paginate-rest from 11.3.5 to 11.3.6 by @dependabot in peter-evans/create-pull-request#3542

build(deps-dev): bump @types/node from 18.19.66 to 18.19.67 by @dependabot in peter-evans/create-pull-request#3543

build(deps-dev): bump prettier from 3.4.0 to 3.4.1 by @dependabot in peter-evans/create-pull-request#3544

build(deps-dev): bump eslint-import-resolver-typescript from 3.6.3 to 3.7.0 by @dependabot in peter-evans/create-pull-request#3559

build(deps-dev): bump prettier from 3.4.1 to 3.4.2 by @dependabot in peter-evans/create-pull-request#3560

build(deps-dev): bump @types/node from 18.19.67 to 18.19.68 by @dependabot in peter-evans/create-pull-request#3570

build(deps): bump p-limit from 6.1.0 to 6.2.0 by @dependabot in peter-evans/create-pull-request#3578

Update distribution by @actions-bot in peter-evans/create-pull-request#3583

fix: preserve unicode in filepaths when commit signing by @peter-evans in peter-evans/create-pull-request#3588

New Contributors

@benmccann made their first contribution in peter-evans/create-pull-request#3475

@scop made their first contribution in peter-evans/create-pull-request#3511

@caugner made their first contribution in peter-evans/create-pull-request#3498

... (truncated)

Commits

67ccf78 fix: preserve unicode in filepaths when commit signing (#3588)
bb88e27 build: update distribution (#3583)
b378ed5 build(deps): bump p-limit from 6.1.0 to 6.2.0 (#3578)
fa9200e build(deps-dev): bump @types/node from 18.19.67 to 18.19.68 (#3570)
16e0059 build(deps-dev): bump prettier from 3.4.1 to 3.4.2 (#3560)
5bffd5a build(deps-dev): bump eslint-import-resolver-typescript (#3559)
a22a0dd build(deps-dev): bump prettier from 3.4.0 to 3.4.1 (#3544)
b27ce37 build(deps-dev): bump @types/node from 18.19.66 to 18.19.67 (#3543)
4e0cc19 build(deps): bump @octokit/plugin-paginate-rest from 11.3.5 to 11.3.6 (#3542)
25b6871 docs: update scopes for push-to-fork
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [github/codeql-action](https://github.com/github/codeql-action) | `3.27.5` | `3.28.0` | | [dagger/dagger-for-github](https://github.com/dagger/dagger-for-github) | `7.0.1` | `7.0.3` | | [actions/setup-go](https://github.com/actions/setup-go) | `5.1.0` | `5.2.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.4.3` | `4.5.0` | | [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `7.0.5` | `7.0.6` | Updates `github/codeql-action` from 3.27.5 to 3.28.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@f09c1c0...48ab28a) Updates `dagger/dagger-for-github` from 7.0.1 to 7.0.3 - [Release notes](https://github.com/dagger/dagger-for-github/releases) - [Commits](dagger/dagger-for-github@e5153f5...847ae44) Updates `actions/setup-go` from 5.1.0 to 5.2.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@41dfa10...3041bf5) Updates `actions/upload-artifact` from 4.4.3 to 4.5.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@b4b15b8...6f51ac0) Updates `peter-evans/create-pull-request` from 7.0.5 to 7.0.6 - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](peter-evans/create-pull-request@5e91468...67ccf78) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: dagger/dagger-for-github dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: peter-evans/create-pull-request dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot requested review from ArthurSens, bwplotka and kakkoyun as code owners January 1, 2025 09:22

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jan 1, 2025

dependabot bot requested a review from vesari as a code owner January 1, 2025 09:22

github-actions bot enabled auto-merge January 1, 2025 09:23

github-actions bot merged commit 168c8cc into main Jan 1, 2025
12 checks passed

github-actions bot deleted the dependabot/github_actions/github-actions-32880cf316 branch January 1, 2025 09:30

This was referenced Feb 19, 2025

fix(deps): update module github.com/prometheus/client_golang to v1.21.0 gardener/gardener#11444

Merged

fix(deps): update module github.com/prometheus/client_golang to v1.21.0 gardener/landscaper#1341

Merged

dghubble-renovate bot mentioned this pull request Feb 19, 2025

Bump github.com/prometheus/client_golang from v1.20.5 to v1.21.0 poseidon/fleetlock#306

Merged

1 task

mr-borboto bot mentioned this pull request Feb 19, 2025

fix(go): update module github.com/prometheus/client_golang ( v1.20.5 → v1.21.1 ) mirceanton/external-dns-provider-mikrotik#200

Merged

1 task

pull-bunyan bot mentioned this pull request Feb 19, 2025

Update module github.com/prometheus/client_golang to v1.22.0 - autoclosed sholdee/adguard-exporter#12

Closed

1 task

pb-renovate bot mentioned this pull request Feb 19, 2025

chore(deps): update module github.com/prometheus/client_golang to v1.21.0 - autoclosed tamcore/imagepullsecret-patcher#29

Closed

1 task

theriver-bot bot mentioned this pull request Feb 19, 2025

fix(deps): update module github.com/prometheus/client_golang to v1.21.0 larivierec/cloudflare-ddns#381

Merged

1 task

larsl-renovate bot mentioned this pull request Feb 19, 2025

fix(deps): update module github.com/prometheus/client_golang to v1.22.0 larsl-net/prompage#19

Merged

1 task

cilium-renovate bot mentioned this pull request Feb 17, 2025

fix(deps): update all go dependencies main (main) (minor) cilium/tetragon#3290

Merged

1 task

rwunderer mentioned this pull request Feb 19, 2025

chore(deps): update module github.com/prometheus/client_golang to v1.21.0 rwunderer/external-dns-cloudns-webhook#16

Merged

1 task

mehr74 mentioned this pull request Oct 3, 2025

Update module github.com/prometheus/client_golang to v1.23.2 optiop/grafana-crash-course#71

Open

1 task

renovate bot mentioned this pull request Oct 8, 2025

chore(go): Update go yggdrion/ping-exporter#4

Merged

1 task

This was referenced Oct 14, 2025

fix(deps): update module github.com/prometheus/client_golang to v1.23.2 grafana/k6#5285

Open

fix(deps): update module github.com/prometheus/client_golang to v1.23.2 grafana/loki-client-go#16

Open

This was referenced Oct 20, 2025

Update module github.com/prometheus/client_golang to v1.23.2 metal-toolbox/fleet-scheduler#96

Open

fix(deps): update module github.com/prometheus/client_golang to v1.23.2 Belphemur/adguard-exporter#17

Open

red-hat-konflux bot mentioned this pull request Oct 21, 2025

fix(deps): update module github.com/prometheus/client_golang to v1.23.2 (backplane-2.6) stolostron/discovery#1139

Closed

1 task

This was referenced Oct 22, 2025

fix(deps): update module github.com/prometheus/client_golang to v1.23.2 sans-sroc/file_exporter#112

Merged

Update module github.com/prometheus/client_golang to v1.23.2 - autoclosed mconfalonieri/external-dns-hetzner-webhook#39

Closed

red-hat-konflux bot mentioned this pull request Oct 24, 2025

Update module github.com/prometheus/client_golang to v1.23.2 app-sre/vault-manager#170

Open

1 task

This was referenced Oct 25, 2025

Update module github.com/prometheus/client_golang to v1.23.2 openshift/file-integrity-operator#769

Open

Update module github.com/prometheus/client_golang to v1.23.2 rhobs/rhobs-synthetics-api#103

Merged

This was referenced Oct 28, 2025

Update all non-major dependencies Stoufiler/JellyWolProxy#3

Merged

Update module github.com/prometheus/client_golang to v1.23.2 appuio/network-canary#56

Open

deps:chore - update module github.com/prometheus/client_golang to v1.23.2 ZupIT/horusec-devkit#206

Open

red-hat-konflux bot mentioned this pull request Nov 1, 2025

fix(deps): update module github.com/prometheus/client_golang to v1.23.2 (release-2.15) - autoclosed stolostron/postgres_exporter#119

Closed

1 task

renovate bot mentioned this pull request Nov 1, 2025

fix(deps): update module github.com/prometheus/client_golang to v1.23.2 sulthonzh/TelyX#18

Open

1 task

renovate-sh-app bot mentioned this pull request Nov 6, 2025

fix(deps): update module github.com/prometheus/client_golang to v1.23.2 grafana/databricks-prometheus-exporter#11

Open

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the github-actions group with 5 updates #1707

build(deps): bump the github-actions group with 5 updates #1707

dependabot bot commented on behalf of github Jan 1, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

build(deps): bump the github-actions group with 5 updates #1707

build(deps): bump the github-actions group with 5 updates #1707

Conversation

dependabot bot commented on behalf of github Jan 1, 2025

v3.28.0

CodeQL Action Changelog

3.28.0 - 20 Dec 2024

v3.27.9

CodeQL Action Changelog

3.27.9 - 12 Dec 2024

v3.27.7

CodeQL Action Changelog

3.27.7 - 10 Dec 2024

v3.27.6

CodeQL Action Changelog

3.27.6 - 03 Dec 2024

CodeQL Action Changelog

[UNRELEASED]

3.28.0 - 20 Dec 2024

3.27.9 - 12 Dec 2024

3.27.8 - 12 Dec 2024

3.27.7 - 10 Dec 2024

3.27.6 - 03 Dec 2024

3.27.5 - 19 Nov 2024

3.27.4 - 14 Nov 2024

3.27.3 - 12 Nov 2024

3.27.2 - 12 Nov 2024

3.27.1 - 08 Nov 2024

v7.0.3

v7.0.2

What's Changed

v5.2.0

What's Changed

New Contributors

v4.5.0

What's Changed

New Contributors

Create Pull Request v7.0.6

What's Changed

New Contributors

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant