chore(deps): bump the actions-deps group across 1 directory with 18 updates by dependabot[bot] · Pull Request #874 · garyttierney/me3

dependabot · 2026-08-31T07:25:53Z

Bumps the actions-deps group with 18 updates in the / directory:

Package	From	To
step-security/harden-runner	`2.14.1`	`2.21.1`
actions/checkout	`6.0.2`	`7.0.1`
tcort/github-action-markdown-link-check	`1.1.2`	`1.1.3`
dtolnay/rust-toolchain	`e97e2d8cc328f1b50210efc529dca0028893a2d9`	`02cb101ec7c40f2c49e1d9714d64511d8e1b74de`
Swatinem/rust-cache	`2.8.2`	`2.9.2`
github/codeql-action/upload-sarif	`4.32.2`	`4.38.2`
codecov/codecov-action	`5.5.2`	`7.1.1`
actions/upload-artifact	`6.0.0`	`7.0.1`
actions/download-artifact	`7.0.0`	`8.0.1`
crowdin/github-action	`2.14.0`	`3.3.0`
actions/labeler	`6.0.1`	`7.0.0`
crazy-max/ghaction-virustotal	`4.2.0`	`5.0.0`
matbour/setup-sentry-cli	`2.0.0`	`3.0.0`
getsentry/action-release	`3.5.0`	`3.7.0`
signpath/github-action-submit-signing-request	`2.2`	`3.0`
actions/attest-build-provenance	`3`	`4`
hugo19941994/delete-draft-releases	`2.0.0`	`3.0.0`
ossf/scorecard-action	`2.4.3`	`2.4.4`

Updates step-security/harden-runner from 2.14.1 to 2.21.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.21.1

What's Changed

Improved performance of the disable-sudo feature.

Fixed an issue in the Community tier where new endpoints required by the GitHub Actions runner were not being implicitly allowed in block mode.

Fixed the Harden-Runner post step failing on Linux distributions that do not have a merged /usr filesystem layout (for example Debian 11), where /usr/bin/echo does not exist. This mainly affected self-hosted runners.

Documentation updates: clarified which features are in the Community (free) vs Enterprise tier.

Full Changelog: step-security/harden-runner@v2.21.0...v2.21.1

v2.21.0

What's Changed

Support for denied endpoints in block mode. This is included in the enterprise tier. Customers can deny outbound calls, for example, to public package registries.

Improved Support for AWS CodeBuild GitHub Actions Runners.

Bug fixes.

Full Changelog: step-security/harden-runner@v2.20.1...v2.21.0

v2.20.1

What's Changed

AWS CodeBuild-hosted runner support

Implicitly allow single-labeled (internal) domains in block-mode

Full Changelog: step-security/harden-runner@v2.20.0...v2.20.1

v2.20.0

What's Changed

Support for block policy for MacOS and Windows GitHub-hosted runners

Support for Bitrise MacOS GitHub Actions runners

HTTPS monitoring support for Bun for Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.19.4...v2.20.0

v2.19.4

What's Changed

Improvements for HTTPS Monitoring for the Enterprise tier of Harden Runner

Full Changelog: step-security/harden-runner@v2.19.3...v2.19.4

v2.19.3

What's Changed

Default to audit mode when api-key missing with use-policy-store by @varunsh-coder in step-security/harden-runner#665

Full Changelog: step-security/harden-runner@v2.19.2...v2.19.3

v2.19.2

What's Changed

Update the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.

... (truncated)

Commits

e14015d Merge pull request #690 from step-security/rc-43
9001249 docs: update harden-runner version pin to v2.21.0 in getting started example
a447fba docs: expand enterprise feature list and document custom VM and ubuntu-slim l...
b0eaf8d docs: clarify community vs enterprise tiers and add maintained actions section
063e8e3 Merge pull request #687 from rohan-stepsecurity/rp/fix/bin-echo-fallback
f46bdc1 chore: bump agent-ebpf to v1.9.1 and agent to v0.16.3
42e6daa fix: fall back to /bin/echo for non-usr-merged distros
05e3151 Merge pull request #684 from step-security/rc-42
0f37afa fix: ignore denied-endpoints on non-enterprise tier
93b58ee fix: resolve cache host read-first and never downgrade egress policy
Additional commits viewable in compare view

Updates actions/checkout from 6.0.2 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464

update error wording by @aiqiaoy in actions/checkout#2467

New Contributors

@aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

[BREAKING] backport allow-unsafe-pr-checkout to v6 by @aiqiaoy in actions/checkout#2500

backport fixes to releases-v6 by @aiqiaoy in actions/checkout#2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

Update changelog by @ericsciple in actions/checkout#2357

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

Update changelog for v6.0.3 by @yaananth in actions/checkout#2446

New Contributors

@yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

Skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

Trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

Escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

v7.0.0

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Various dependency updates

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

... (truncated)

Commits

3d3c42e prep v7.0.1 release (#2531)
2880268 escape values passed to --unset (#2530)
12cd223 trim only ascii whitespace for branch (#2521)
62661c4 skip running unsafe pr check if input is default (#2518)
e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
631c942 eslint 9 (#2474)
4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
ba09753 Bump actions/checkout from 6 to 7 (#2488)
b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
Additional commits viewable in compare view

Updates tcort/github-action-markdown-link-check from 1.1.2 to 1.1.3

Changelog

Sourced from tcort/github-action-markdown-link-check's changelog.

Changes

Version 1.1.3

update entrypoint.sh to use markdown-link-check 3.15.0

update Dockerfile to use node:24.18.0-alpine3.24

Add CHANGELOG.md and MAINT.md

Commits

e047c5b chore(entrypoint): new markdown-link-check
f324e89 chore(Dockerfile): update to node:24.18.0-alpine3.24
See full diff in compare view

Updates dtolnay/rust-toolchain from e97e2d8cc328f1b50210efc529dca0028893a2d9 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de

Commits

02cb101 Merge pull request 185 from fufesou/feat/force-non-host
b38a663 Pass --force-non-host unconditionally
a4f61a0 Document rustup non-host opt-in requirement
06b350f Support force-non-host toolchains
d103106 Predefine branches up to 1.120
3ea7b2d Add 1.98.1 patch release
6c977a6 Merge pull request #182 from dtolnay/name
f3510ff Render better step names
2c7215f Add 1.97.1 patch release
fa04a14 Add 1.96.1 patch release
Additional commits viewable in compare view

Updates Swatinem/rust-cache from 2.8.2 to 2.9.2

Release notes

Sourced from Swatinem/rust-cache's releases.

v2.9.2

What's Changed

Typofix by @23Skidoo in Swatinem/rust-cache#316

fix: include target names in build/ and .fingerprint/ cleanup by @eitsupi in Swatinem/rust-cache#317

fix: include cdylib/rlib/dylib/staticlib targets in build and fingerprint cleanup by @eitsupi in Swatinem/rust-cache#320

Scan content of $CARGO_HOME/bin on restore instead of relying on cargo install metadata by @clechasseur in Swatinem/rust-cache#325

docs: Update checkout action version to latest by @sondrelg in Swatinem/rust-cache#345

Fix Windows cache path validation after Rollup migration by @eitsupi in Swatinem/rust-cache#355

fix: support Cargo V2 build dir layout by @claytonwramsey in Swatinem/rust-cache#371

New Contributors

@23Skidoo made their first contribution in Swatinem/rust-cache#316

@eitsupi made their first contribution in Swatinem/rust-cache#317

@clechasseur made their first contribution in Swatinem/rust-cache#325

@sondrelg made their first contribution in Swatinem/rust-cache#345

@claytonwramsey made their first contribution in Swatinem/rust-cache#371

Full Changelog: Swatinem/rust-cache@v2.9.1...v2.9.2

v2.9.1

Fix regression in hash calculation

Full Changelog: Swatinem/rust-cache@v2.9.0...v2.9.1

v2.9.0

What's Changed

Add support for running rust-cache commands from within a Nix shell by @marc0246 in Swatinem/rust-cache#290

Bump taiki-e/install-action from 2.62.57 to 2.62.60 in the actions group by @dependabot[bot] in Swatinem/rust-cache#291

Bump the actions group across 1 directory with 5 updates by @dependabot[bot] in Swatinem/rust-cache#296

Bump the prd-major group with 3 updates by @dependabot[bot] in Swatinem/rust-cache#294

Bump @types/node from 24.10.1 to 25.0.2 in the dev-major group by @dependabot[bot] in Swatinem/rust-cache#295

Consider all installed toolchains in cache key by @tamird in Swatinem/rust-cache#293

Compare case-insenitively for full cache key match by @kbriggs in Swatinem/rust-cache#303

Migrate to node24 runner by @rhysd in Swatinem/rust-cache#314

Bump the actions group across 1 directory with 7 updates by @dependabot[bot] in Swatinem/rust-cache#312

Bump the prd-minor group across 1 directory with 2 updates by @dependabot[bot] in Swatinem/rust-cache#307

Bump @types/node from 25.0.2 to 25.2.2 in the dev-minor group by @dependabot[bot] in Swatinem/rust-cache#309

New Contributors

@marc0246 made their first contribution in Swatinem/rust-cache#290

@tamird made their first contribution in Swatinem/rust-cache#293

@kbriggs made their first contribution in Swatinem/rust-cache#303

Full Changelog: Swatinem/rust-cache@v2.8.2...v2.9.0

Changelog

Sourced from Swatinem/rust-cache's changelog.

Changelog

2.9.2

Fix credentials.toml cleanup

Improvements to cleanup, preserving more valid targets

Improvements to cargo install handling

Correctly sort/dedupe Rust versions

2.9.1

Fix regression in hash calculation

2.9.0

Update to node24

Support running from within a nix shell

Consider all installed toolchains for cache key

Use case-insensitive comparison to determine exact cache hit

2.8.2

Don't overwrite env for cargo-metadata call

2.8.1

Set empty CARGO_ENCODED_RUSTFLAGS when retrieving metadata

Various dependency updates

2.8.0

Add support for warpbuild cache provider

Add new cache-workspace-crates feature

2.7.8

Include CPU arch in the cache key

2.7.7

Also cache cargo install metadata

2.7.6

Allow opting out of caching $CARGO_HOME/bin

Add runner OS in cache key

Adds an option to do lookup-only of the cache

2.7.5

... (truncated)

Commits

6323deb 2.9.2
b16e8d7 bump rollup and rebuild
3bf42ac invert target/profile check in cleanup
6e5b278 correctly sort and dedupe Rust versions
5adc05f Bump the actions group across 1 directory with 3 updates (#368)
66b1e95 fix: support Cargo V2 build dir layout (#371)
72d126e Merge pull request #367 from Swatinem/dependabot/npm_and_yarn/dev-patch-2b495...
48968d2 Bump the dev-patch group with 2 updates
9f151ac update dependencies, rebuild
0e24e5d Bump the actions group across 1 directory with 6 updates (#364)
Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.32.2 to 4.38.2

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.38.2

Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

v4.37.7

Update default CodeQL bundle version to 2.26.3. #4085

v4.37.6

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

v4.37.4

This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037

Update default CodeQL bundle version to 2.26.2. #4051

v4.37.3

No user facing changes.

v4.37.2

The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

v4.37.1

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

v4.37.0

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v4.36.3

No user facing changes.

v4.36.2

Cache CodeQL CLI version information across Actions steps. #3943

... (truncated)

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.2 - 24 Sept 2026

Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037

Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

... (truncated)

Commits

2892aa5 Merge pull request #4168 from github/update-v4.38.2-a6ef2c96f
8ad03a3 Trigger workflows
98af865 Update changelog for v4.38.2
a6ef2c9 Merge pull request #4156 from github/mario-campos/fix-validate-cmd
1ef28a1 Merge pull request #4166 from github/dependabot/github_actions/dot-github/wor...
26cb08b Merge pull request #4163 from github/mbg/fix-getCommitOid-stubs
f035ce3 Merge pull request #4165 from github/dependabot/npm_and_yarn/npm-minor-8eaed9...
5e4e255 Rebuild
b13f5f4 Bump ruby/setup-ruby
c87fe57 Rebuild
Additional commits viewable in compare view

Updates codecov/codecov-action from 5.5.2 to 7.1.1

Release notes

Sourced from codecov/codecov-action's releases.

v7.1.1

What's Changed

chore(release): 7.1.1 by @thomasrockhu-codecov in codecov/codecov-action#1973

Full Changelog: codecov/codecov-action@v7.1.0...v7.1.1

v7.1.0

What's Changed

chore(release): 7.1.0 by @thomasrockhu-codecov in codecov/codecov-action#1971

Full Changelog: codecov/codecov-action@v7.0.0...v7.1.0

v7.0.0

⚠️ Due to migration issues with keybase, we are unable to update our keys under the codecovsecurity account. We have deleted the account and are using codecovsecops with the original gpg key

What's Changed

ci: remove Enforce License Compliance workflow by @thomasrockhu-codecov in codecov/codecov-action#1950

chore(release): 7.0.0 by @thomasrockhu-codecov in codecov/codecov-action#1957

Full Changelog: codecov/codecov-action@v6.0.1...v7.0.0

v6.0.2

This is a copy of the v7.0.0 release to make updates easier

What's Changed

ci: remove Enforce License Compliance workflow by @thomasrockhu-codecov in codecov/codecov-action#1950

chore(release): 7.0.0 by @thomasrockhu-codecov in codecov/codecov-action#1957

Full Changelog: codecov/codecov-action@v6.0.1...v6.0.2

v6.0.1

What's Changed

fix: prevent template injection in run: steps (VULN-1652) by @thomasrockhu-codecov in codecov/codecov-action#1947

chore(release): 6.0.1 by @thomasrockhu-codecov in codecov/codecov-action#1949

Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1

v6.0.0

⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️

What's Changed

Revert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0"" by @thomasrockhu-codecov in codecov/codecov-action#1929

Th/6.0.0 by @thomasrockhu-codecov in codecov/codecov-action#1928

... (truncated)

Commits

303a32d chore(release): 7.1.1 (#1973)
0b35c9e chore(release): 7.1.0 (#1971)
fb8b358 chore(release): 7.0.0 (#1957)
ca0a928 ci: remove Enforce License Compliance workflow (#1950)
e79a696 chore(release): 6.0.1 (#1949)
51e6422 fix: prevent template injection in run: steps (VULN-1652) (#1947)
57e3a13 Th/6.0.0 (#1928)
f67d33d Revert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0""...
75cd116 chore(release): 5.5.4 (#1927)
87d39f4 Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0" (#1926)
Additional commits viewable in compare view

Updates actions/upload-artifact from 6.0.0 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Update the readme with direct upload details by @danwkennedy in actions/upload-artifact#795

Readme: bump all the example versions to v7 by @danwkennedy in actions/upload-artifact#796

Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Add proxy integration test by @Link- in actions/upload-artifact#754

Upgrade the module to ESM and bump dependencies by @danwkennedy in actions/upload-artifact#762

Support direct file uploads by @danwkennedy in actions/upload-artifact#764

New Contributors

@Link- made their first contribution in actions/upload-artifact#754

Full Changelog: actions/upload-artifact@v6...v7.0.0

Commits

043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
634250c Include changes in typespec/ts-http-runtime 0.3.5
e454baa Readme: bump all the example versions to v7 (#796)
74fad66 Update the readme with direct upload details (#795)
bbbca2d Support direct file uploads (#764)
589182c Upgrade the module to ESM and bump dependencies (#762)
47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
02a8460 Add proxy integration test
See full diff in compare view

Updates actions/download-artifact from 7.0.0 to 8.0.1

Release notes

Sourced from actions/download-artifact's releases.

v8.0.1

What's Changed

Support for CJK characters in the artifact name by @danwkennedy in actions/download-artifact#471

Add a regression test for artifact name + content-type mismatches by @danwkennedy in actions/download-artifact#472

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.Description has been truncated

…pdates Bumps the actions-deps group with 18 updates in the / directory: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.14.1` | `2.21.1` | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.1` | | [tcort/github-action-markdown-link-check](https://github.com/tcort/github-action-markdown-link-check) | `1.1.2` | `1.1.3` | | [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) | `e97e2d8cc328f1b50210efc529dca0028893a2d9` | `02cb101ec7c40f2c49e1d9714d64511d8e1b74de` | | [Swatinem/rust-cache](https://github.com/swatinem/rust-cache) | `2.8.2` | `2.9.2` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.32.2` | `4.38.2` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.5.2` | `7.1.1` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6.0.0` | `7.0.1` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `7.0.0` | `8.0.1` | | [crowdin/github-action](https://github.com/crowdin/github-action) | `2.14.0` | `3.3.0` | | [actions/labeler](https://github.com/actions/labeler) | `6.0.1` | `7.0.0` | | [crazy-max/ghaction-virustotal](https://github.com/crazy-max/ghaction-virustotal) | `4.2.0` | `5.0.0` | | [matbour/setup-sentry-cli](https://github.com/matbour/setup-sentry-cli) | `2.0.0` | `3.0.0` | | [getsentry/action-release](https://github.com/getsentry/action-release) | `3.5.0` | `3.7.0` | | [signpath/github-action-submit-signing-request](https://github.com/signpath/github-action-submit-signing-request) | `2.2` | `3.0` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `3` | `4` | | [hugo19941994/delete-draft-releases](https://github.com/hugo19941994/delete-draft-releases) | `2.0.0` | `3.0.0` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.3` | `2.4.4` | Updates `step-security/harden-runner` from 2.14.1 to 2.21.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@e3f713f...e14015d) Updates `actions/checkout` from 6.0.2 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...3d3c42e) Updates `tcort/github-action-markdown-link-check` from 1.1.2 to 1.1.3 - [Release notes](https://github.com/tcort/github-action-markdown-link-check/releases) - [Changelog](https://github.com/tcort/github-action-markdown-link-check/blob/master/CHANGELOG.md) - [Commits](tcort/github-action-markdown-link-check@e7c7a18...e047c5b) Updates `dtolnay/rust-toolchain` from e97e2d8cc328f1b50210efc529dca0028893a2d9 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de - [Release notes](https://github.com/dtolnay/rust-toolchain/releases) - [Commits](dtolnay/rust-toolchain@e97e2d8...02cb101) Updates `Swatinem/rust-cache` from 2.8.2 to 2.9.2 - [Release notes](https://github.com/swatinem/rust-cache/releases) - [Changelog](https://github.com/Swatinem/rust-cache/blob/master/CHANGELOG.md) - [Commits](Swatinem/rust-cache@779680d...6323deb) Updates `github/codeql-action/upload-sarif` from 4.32.2 to 4.38.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@45cbd0c...2892aa5) Updates `codecov/codecov-action` from 5.5.2 to 7.1.1 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@671740a...303a32d) Updates `actions/upload-artifact` from 6.0.0 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v6...043fb46) Updates `actions/download-artifact` from 7.0.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@37930b1...3e5f45b) Updates `crowdin/github-action` from 2.14.0 to 3.3.0 - [Release notes](https://github.com/crowdin/github-action/releases) - [Commits](crowdin/github-action@b4b468c...9c23991) Updates `actions/labeler` from 6.0.1 to 7.0.0 - [Release notes](https://github.com/actions/labeler/releases) - [Commits](actions/labeler@634933e...bf12e9b) Updates `crazy-max/ghaction-virustotal` from 4.2.0 to 5.0.0 - [Release notes](https://github.com/crazy-max/ghaction-virustotal/releases) - [Commits](crazy-max/ghaction-virustotal@d34968c...936d8c5) Updates `matbour/setup-sentry-cli` from 2.0.0 to 3.0.0 - [Release notes](https://github.com/matbour/setup-sentry-cli/releases) - [Changelog](https://github.com/matbour/setup-sentry-cli/blob/main/CHANGELOG.md) - [Commits](matbour/setup-sentry-cli@3e938c5...ff4fff7) Updates `getsentry/action-release` from 3.5.0 to 3.7.0 - [Release notes](https://github.com/getsentry/action-release/releases) - [Changelog](https://github.com/getsentry/action-release/blob/master/CHANGELOG.md) - [Commits](getsentry/action-release@dab6548...ff07929) Updates `signpath/github-action-submit-signing-request` from 2.2 to 3.0 - [Release notes](https://github.com/signpath/github-action-submit-signing-request/releases) - [Commits](SignPath/github-action-submit-signing-request@b9d91ea...f6d0478) Updates `actions/attest-build-provenance` from 3 to 4 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@v3...v4) Updates `hugo19941994/delete-draft-releases` from 2.0.0 to 3.0.0 - [Release notes](https://github.com/hugo19941994/delete-draft-releases/releases) - [Commits](hugo19941994/delete-draft-releases@v2.0.0...v3.0.0) Updates `ossf/scorecard-action` from 2.4.3 to 2.4.4 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@4eaacf0...2d11466) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-deps - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-deps - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-deps - dependency-name: actions/labeler dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-deps - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-deps - dependency-name: codecov/codecov-action dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-deps - dependency-name: crazy-max/ghaction-virustotal dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-deps - dependency-name: crowdin/github-action dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-deps - dependency-name: dtolnay/rust-toolchain dependency-version: 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 dependency-type: direct:production dependency-group: actions-deps - dependency-name: getsentry/action-release dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: hugo19941994/delete-draft-releases dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-deps - dependency-name: matbour/setup-sentry-cli dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-deps - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: signpath/github-action-submit-signing-request dependency-version: '2.3' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: step-security/harden-runner dependency-version: 2.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: Swatinem/rust-cache dependency-version: 2.9.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: tcort/github-action-markdown-link-check dependency-version: 1.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 31, 2026

dependabot Bot requested review from Dasaav-dsv and garyttierney as code owners August 31, 2026 07:25

github-project-automation Bot added this to me3 Aug 31, 2026

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 31, 2026

github-project-automation Bot moved this to Todo in me3 Aug 31, 2026

dependabot Bot force-pushed the dependabot/github_actions/actions-deps-3ccb0f0003 branch 2 times, most recently from 4415822 to ce8f306 Compare September 29, 2026 07:26

dependabot Bot force-pushed the dependabot/github_actions/actions-deps-3ccb0f0003 branch from ce8f306 to 445de5c Compare September 30, 2026 07:27

Navigation Menu

Repository navigation

chore(deps): bump the actions-deps group across 1 directory with 18 updates - #874

chore(deps): bump the actions-deps group across 1 directory with 18 updates#874
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-deps-3ccb0f0003

dependabot Bot commented on behalf of github Aug 31, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.21.1

What's Changed

v2.21.0

What's Changed

v2.20.1

What's Changed

v2.20.0

What's Changed

v2.19.4

What's Changed

v2.19.3

What's Changed

v2.19.2

What's Changed

v7.0.1

What's Changed

v7.0.0

What's Changed

New Contributors

v6.1.0

What's Changed

v6.0.3

What's Changed

New Contributors

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

Changes

Version 1.1.3

v2.9.2

What's Changed

New Contributors

v2.9.1

v2.9.0

What's Changed

New Contributors

Changelog

2.9.2

2.9.1

2.9.0

2.8.2

2.8.1

2.8.0

2.7.8

2.7.7

2.7.6

2.7.5

v4.38.2

v4.38.1

v4.38.0

v4.37.9

v4.37.8

v4.37.7

v4.37.6

v4.37.5

v4.37.4

v4.37.3

v4.37.2

v4.37.1

v4.37.0

v4.36.3

v4.36.2

CodeQL Action Changelog

[UNRELEASED]

4.38.2 - 24 Sept 2026

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

dependabot Bot commented on behalf of github Aug 31, 2026 •

edited

Loading