Skip to content
This repository was archived by the owner on Oct 27, 2026. It is now read-only.

chore(deps): update github-actions - #130

Merged
arcaven merged 1 commit into
developfrom
renovate/github-actions
Oct 27, 2026
Merged

chore(deps): update github-actions#130
arcaven merged 1 commit into
developfrom
renovate/github-actions

Conversation

@renovate

@renovate renovate Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
EmbarkStudios/cargo-deny-action action minor v2 → v2.1.1
actions/attest action minor v4.1.0 → v4.2.2
actions/checkout action patch v7.0.0 → v7.0.1
actions/checkout action minor v6 → v6.1.0
actions/download-artifact action patch v8.0.1 → v8.0.2
actions/upload-artifact action patch v7.0.1 → v7.0.2
github/codeql-action action minor v4.36.3 → v4.39.1
github/codeql-action action minor v4.36.2 → v4.39.1
ossf/scorecard-action action minor v2.4.3 → v2.5.0

Release Notes

EmbarkStudios/cargo-deny-action

v2.1.1: Release 2.1.1 - cargo-deny 0.20.2

Compare Source

Fixed

  • PR#116 fixed in issue introduced in the 2.1.0 release due the deprecation of the use-git-cli argument. Thanks @​Firestar99!

v2.1.0: Release 2.1.0 - cargo-deny 0.20.2

Compare Source

Changed
  • PR#881 refactored the CLI, moving some duplicated options/flags into the root and removing several deprecated options/flags/values. See the PR for a full list of changes.
Added
  • PR#879 resolved #​873 by adding a new bans.std-replacements lint which checks the graph for crates.io sourced crates that have been partially or fully replaced in std and/or core.
Fixed
  • PR#880 resolved #​765 by respecting non-default build script paths in manifests.
  • PR#881 resolved #​874 by cleaning up the CLI, deduplicating some options/flags that caused bug in the list subcommand.

v2.0.20: Release 2.0.20 - cargo-deny 0.19.8

Compare Source

Fixed
  • PR#864 fixed matching of ^ and ~ with on prerelease versions for when checking if a crate is affected by an advisory. As of the time of the PR, this literally affected none of published versions of any crate with an advisory, but this just ensures such a case will be handled in the future.

v2.0.19: Release 2.0.19 - cargo-deny 0.19.7

Compare Source

Changed

v2.0.18: Release 2.0.18 - cargo-deny 0.19.5

Compare Source

Fixed

v2.0.17: Release 2.0.17 - cargo-deny 0.19.2

Compare Source

Fixed

v2.0.16: Release 2.0.16 - cargo-deny 0.19.1

Compare Source

Fixed
  • PR#833 fixed an issue where the maximum advisory database staleness was over 14 years instead of the intended 90 days.
  • PR#839 fixed an issue where unsound advisories would appear for transitive dependencies despite requesting them only for workspace dependencies, resolving #​829.
  • PR#840 resolved #​797 by passing --filter-platform when collecting cargo metadata if only a single target was requested either in the config or via the command line.
  • PR#841 fixed an issue where --frozen would not disable fetching of the advisory DB, resolving #​759.
  • PR#842 and PR#844 updated crates. Notably krates was updated to resolve two issues with crates being pruned from the graph used when running checks. Resolving these two issues may mean that updating cargo-deny may highlight issues that were previously hidden.
    • EmbarkStudios/krates#106 would fail to pull in crates brought in via a feature if that crate had its lib target renamed by the package author.
    • EmbarkStudios/krates#109 would fail to bring in optional dependencies if they were brought in by a weak feature in a crate also brought in by a weak feature.
Changed
  • PR#830 removed gix in favor of shelling out to git. This massively improves build times and eases maintenance as gix bumps minor versions quite frequently. If cargo-deny is used in an environment that for some reason allows internet access but doesn't have git available, the advisory database would need to be updated before calling cargo-deny.
  • PR#838 removed rustsec in favor of manually implemented advisory parsing and checking, with a nightly cron job that checks that the implementation exactly matches rustsec on the official rustsec advisory db.

v2.0.15: Release 2.0.15 - cargo-deny 0.19.0

Compare Source

Changed
  • PR#802 made relative paths passed to --config be resolved relative to the current working directory (rather than the resolved manifest path's directory).
  • PR#825 updated gix, reqwest, and tame-index to newer versions. The reqwest 0.13 changes means it is no longer possible to choose the source of root certificates for gix, so that decision is now left to rustls-platform-verifier. The native-certs feature has thus been removed, and cargo-deny no longer defaults to using webpki-roots.
Fixed
  • PR#802 fixed path handling of paths passed to --config, resolving #​748.
  • PR#819 added locations to all SARIF results since that's mandatory for valid SARIF.
  • PR#821 fixed compilation on an Alpine host.
Added
  • PR#795 added [bans.allow-workspace] to allow workspace crates while denying all external crates.
  • PR#800 added [licenses.include-build] to toggle whether build dependencies are included in the license check.
  • PR#823 added [advisories.unused-ignored-advisory] to disable the warning when an advisory is ignored but not encountered in the crate graph.
  • PR#826 added [advisories.unsound] to determine which crates can show unsound advisories, similarly to the unmaintained field. Defaults to workspace crates, ignoring unsound advisories for transitive dependencies, resolving #​824.

v2.0.14: Release 2.0.14 - cargo-deny 0.18.6

Compare Source

0.18.5

Changed
  • PR#789 changed it so that release binaries are now built with LTO.
  • PR#790 and PR#794 updated various crates.
Added
  • PR#790 added SARIF as an output format, usable via --format sarif. The current output for this format is experimental and may change in future updates.

0.18.6

Fixed
  • PR#805 updated rustsec to 0.31, resolving #​804.
  • PR#810 resolved #​809 by printing the crate name and version when its manifest does not contain a license expression.
Added
  • PR#807 added the unused-license-exception option to configure the lint level, resolving #​806.
Changed

v2.0.13: Release 2.0.13 - cargo-deny 0.18.4

Compare Source

Added
  • PR#779 added the --metadata-path argument to use a cargo metadata JSON file instead of calling cargo metadata, resolving #​777.
  • PR#782 added sources.unused-allow-source to allow configuration of the lint level when a source is allowed but not used by any crate in the graph, closing #​781.
Changed
  • PR#786 changed the license check output. / is no longer corrected to OR, and if the license expression is found in the package's manifest, that span is used in diagnostic messages instead of the synthesized manifest.
Fixed
  • PR#786 resolved #​784 by updating spdx to a new version that forces all GNU licenses to be exactly equal when comparing license expressions to licensee expressions, which is incredibly pedantic, but means the license comparison is entirely in the hands of the user so that I no longer have to deal with GNU licenses.

v2.0.12: Release 2.0.12 - cargo-deny 0.18.3

Compare Source

Changed
  • PR#773 changed cargo-deny's duplicate detection to automatically ignore versions whose only dependent is another version of the same crate.

v2.0.11

Compare Source

[0.18.2] - 2025-03-10

Added
  • PR#753 resolved #​752 by adding back the advisories.unmaintained config option. See the docs for how it can be used. The default matches the current behavior, which is to error on any unmaintained advisory, but adding unmaintained = "workspace" to the [advisories] table will mean unmaintained advisories will only error if the crate is a direct dependency of your workspace.

[0.18.1] - 2025-02-27

Fixed

v2.0.10

Compare Source

  • PR#96 resolved #​94 by switching to the directory the manifest path is located in and doing rustup toolchain install if rustup show failed due to any reason

v2.0.9: Release 2.0.9 - cargo-deny 0.18.0

Compare Source

  • d8395c1 removed the rustup update.

v2.0.8

Compare Source

  • PR#93 pins to a hash instead of tag, avoiding future breakage from eg. rustup changes.

v2.0.7: Release 2.0.7 - cargo-deny 0.18.0

Compare Source

  • PR#92 fixed an issue introduced by the latest rustup release.

v2.0.6: Release 2.0.6 - cargo-deny 0.18.0

Compare Source

Changed
  • PR#746 changed the directory naming of advisory databases, again, so the name uses the last path component and a different, but also stable, hashing algorithm. Eg. the default https://github.com/rustsec/advisory-db will now be placed in $CARGO_HOME/advisory-dbs/advisory-db-3157b0e258782691.
  • PR#746 changed the MSRV to 1.85.0 and uses edition 2024.
Fixed
  • PR#746 fixes an issue when using cargo 1.85.0 where source urls were not being properly assigned to crates.io due to the constant being used no longer matching the new path used in cargo 1.85.0 causing eg. workspace dependency checks to fail.

v2.0.5: Release 2.0.5 - cargo-deny 0.17.0

Compare Source

Changed
  • PR#745 updated tame-index to 0.18.0 so that cargo 1.85.0 is transparently supported along with older cargo versions.
  • PR#745 now uses the same stable hashing as cargo 1.85.0 for the advisory databases, which changes their path, but will notably now be the same across all host platforms.

v2.0.4: Release 2.0.4 - cargo-deny 0.16.3

Compare Source

  • Update base image to rust 1.83.0 so that version 4 lockfiles are supported with no config changes

v2.0.3: Release 2.0.3 - cargo-deny 0.16.3

Compare Source

Changed
  • PR#721 updated rust-version to 1.81.0 to accurately reflect the minimum rust version required to compile, resolving #​720.
  • PR#722 updated the SPDX license list to 3.25.0.
Fixed
  • PR#726 resolved #​725 by adding the unnecessary-skip diagnostic, emitted when there is a skip configured for a crate that only has one version in the graph.

v2.0.2: Release 2.0.2 - cargo-deny 0.16.2

Compare Source

Fixed
  • PR#703 resolved #​696 by no longer emitting errors when failing to deserialize deprecated fields, and removed some lingering documentation that wasn't removed in PR#611.
  • PR#719 updated to krates -> 0.17.5, fixing an issue where cargo-deny could panic due to incorrectly resolving features for different versions of the same crate referenced by a single crate.
  • PR#719 resolved #​706 by removing a warning issued when users use ignored scheme modifiers for source urls.
  • PR#719 resolved #​718 by updating the book with missing arguments.
Added
  • PR#715 resolved #​714 by adding support for Edition 2024. Thanks @​kpcyrd!
  • PR#710 resolved #​708 by allowing for unpublished workspace crates to be excluded from the dependency graph that checks are run against, either via the --exclude-unpublished CLI argument or the graph.exclude-unpublished config field. Thanks @​Tastaturtaste!
Changed
  • PR#711 updated goblin -> 0.9.2
  • PR#713 updated various crates, notably rustsec -> 0.30.

v2.0.1: Release 2.0.1 - cargo-deny 0.16.1

Compare Source

Fixed
  • PR#691 fixed an issue where workspace dependencies that used the current dir '.' path component would incorrectly trigger the unused-workspace-dependency lint.
actions/attest

v4.2.2

Compare Source

What's Changed

Full Changelog: actions/attest@v4.2.1...v4.2.2

v4.2.1

Compare Source

What's Changed

Full Changelog: actions/attest@v4.2.0...v4.2.1

v4.2.0

Compare Source

What's Changed

Full Changelog: actions/attest@v4.1.1...v4.2.0

v4.1.1

Compare Source

What's Changed

Full Changelog: actions/attest@v4.1.0...v4.1.1

actions/checkout

v7.0.1

Compare Source

actions/download-artifact

v8.0.2

Compare Source

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

actions/upload-artifact

v7.0.2

Compare Source

What's Changed

  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.

New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

github/codeql-action

v4.39.1

Compare Source

v4.39.0

Compare Source

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #​4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #​4198

v4.38.3

Compare Source

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4188
  • Update default CodeQL bundle version to 2.27.2. #​4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #​4184

v4.38.2

Compare Source

v4.38.1

Compare Source

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #​4146

v4.38.0

Compare Source

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #​4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #​4072
  • Update default CodeQL bundle version to 2.27.0. #​4129

v4.37.9

Compare Source

v4.37.8

Compare Source

No user facing changes.

v4.37.7

Compare Source

v4.37.6

Compare Source

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #​4070

v4.37.5

Compare Source

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #​4061

v4.37.4

Compare Source

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #​4037
  • Update default CodeQL bundle version to 2.26.2. #​4051

v4.37.3

Compare Source

No user facing changes.

v4.37.2

Compare Source

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #​4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #​4007

v4.37.1

Compare Source

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #​3956
  • Update default CodeQL bundle version to 2.26.1. #​4019

v4.37.0

Compare Source

  • Update default CodeQL bundle version to 2.26.0. #​3995
  • In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #​3973
ossf/scorecard-action

v2.5.0

Compare Source

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted
services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the
Scorecard v5.6.0 release notes.

  • The action's container image is built with Go 1.27.2 on a refreshed distroless base. by
    @​justaugustus in #​1716
  • The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still
    recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @​justaugustus in #​1716
  • The Scorecard version in results now always matches the Scorecard release the action is built
    with. by @​justaugustus in #​1718
  • The action no longer prints the GitHub token variable while validating its options. by
    @​arpitjain099 in #​1709
  • results_format accepts intoto, which wraps the JSON results in an in-toto attestation
    statement. by @​puerco in #​1702
Other

New Contributors

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

v2.4.4

Compare Source

What's Changed

This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the Scorecard v5.4.0 release notes and the Scorecard v5.5.0 release notes.

Full Changelog: ossf/scorecard-action@v2.4.3...v2.4.4

Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Oct 26, 2026
@renovate
renovate Bot requested a review from arcaven as a code owner October 26, 2026 00:47
@arcaven
arcaven enabled auto-merge (squash) October 27, 2026 15:30
@renovate
renovate Bot force-pushed the renovate/github-actions branch from 235f640 to c08fab9 Compare October 27, 2026 15:31
@arcaven
arcaven disabled auto-merge October 27, 2026 15:31
@arcaven
arcaven merged commit 4716e68 into develop Oct 27, 2026
9 of 11 checks passed
@arcaven
arcaven deleted the renovate/github-actions branch October 27, 2026 15:31
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@arcaven arcaven Awaiting requested review from arcaven arcaven is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@arcaven