Bump the github-actions group with 7 updates #1541

dependabot · 2025-04-01T13:09:56Z

Bumps the github-actions group with 7 updates:

Package	From	To
actions/checkout	`3.1.0`	`4.2.2`
actions/upload-artifact	`3.1.0`	`4.6.2`
actions/github-script	`3`	`7`
actions/labeler	`4`	`5`
actions/attest-build-provenance	`1.0.0`	`2.2.3`
ossf/scorecard-action	`2.3.1`	`2.4.1`
github/codeql-action	`2.2.4`	`3.28.13`

Updates actions/checkout from 3.1.0 to 4.2.2

Release notes

Sourced from actions/checkout's releases.

v4.2.2

What's Changed

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

Full Changelog: actions/checkout@v4.2.1...v4.2.2

v4.2.1

What's Changed

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

New Contributors

@Jcambass made their first contribution in actions/checkout#1919

Full Changelog: actions/checkout@v4.2.0...v4.2.1

v4.2.0

What's Changed

Add Ref and Commit outputs by @lucacome in actions/checkout#1180

Dependabot updates in actions/checkout#1777 & actions/checkout#1872

New Contributors

@yasonk made their first contribution in actions/checkout#1869

@lucacome made their first contribution in actions/checkout#1180

Full Changelog: actions/checkout@v4.1.7...v4.2.0

v4.1.7

What's Changed

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in actions/checkout#1739

Bump actions/checkout from 3 to 4 by @dependabot in actions/checkout#1697

Check out other refs/* by commit by @orhantoy in actions/checkout#1774

Pin actions/checkout's own workflows to a known, good, stable version. by @jww3 in actions/checkout#1776

New Contributors

@orhantoy made their first contribution in actions/checkout#1774

Full Changelog: actions/checkout@v4.1.6...v4.1.7

v4.1.6

What's Changed

Check platform to set archive extension appropriately by @cory-miller in actions/checkout#1732

Update for 4.1.6 release by @cory-miller in actions/checkout#1733

Full Changelog: actions/checkout@v4.1.5...v4.1.6

v4.1.5

What's Changed

... (truncated)

Commits

11bd719 Prepare 4.2.2 Release (#1953)
e3d2460 Expand unit test coverage (#1946)
163217d url-helper.ts now leverages well-known environment variables. (#1941)
eef6144 Prepare 4.2.1 release (#1925)
6b42224 Add workflow file for publishing releases to immutable action package (#1919)
de5a000 Check out other refs/* by commit if provided, fall back to ref (#1924)
d632683 Prepare 4.2.0 release (#1878)
6d193bf Bump braces from 3.0.2 to 3.0.3 (#1777)
db0cee9 Bump the minor-npm-dependencies group across 1 directory with 4 updates (#1872)
b684943 Add Ref and Commit outputs (#1180)
Additional commits viewable in compare view

Updates actions/upload-artifact from 3.1.0 to 4.6.2

Release notes

Sourced from actions/upload-artifact's releases.

v4.6.2

What's Changed

Update to use artifact 2.3.2 package & prepare for new upload-artifact release by @salmanmkc in actions/upload-artifact#685

New Contributors

@salmanmkc made their first contribution in actions/upload-artifact#685

Full Changelog: actions/upload-artifact@v4...v4.6.2

v4.6.1

What's Changed

Update to use artifact 2.2.2 package by @yacaovsnc in actions/upload-artifact#673

Full Changelog: actions/upload-artifact@v4...v4.6.1

v4.6.0

What's Changed

Expose env vars to control concurrency and timeout by @yacaovsnc in actions/upload-artifact#662

Full Changelog: actions/upload-artifact@v4...v4.6.0

v4.5.0

What's Changed

fix: deprecated Node.js version in action by @hamirmahal in actions/upload-artifact#578

Add new artifact-digest output by @bdehamer in actions/upload-artifact#656

New Contributors

@hamirmahal made their first contribution in actions/upload-artifact#578

@bdehamer made their first contribution in actions/upload-artifact#656

Full Changelog: actions/upload-artifact@v4.4.3...v4.5.0

v4.4.3

What's Changed

Undo indirect dependency updates from #627 by @joshmgross in actions/upload-artifact#632

Full Changelog: actions/upload-artifact@v4.4.2...v4.4.3

v4.4.2

What's Changed

Bump @actions/artifact to 2.1.11 by @robherley in actions/upload-artifact#627

Includes fix for relative symlinks not resolving properly

Full Changelog: actions/upload-artifact@v4.4.1...v4.4.2

v4.4.1

... (truncated)

Commits

ea165f8 Merge pull request #685 from salmanmkc/salmanmkc/3-new-upload-artifacts-release
0839620 Prepare for new release of actions/upload-artifact with new toolkit cache ver...
4cec3d8 Merge pull request #673 from actions/yacaovsnc/artifact_2.2.2
e9fad96 license cache update for artifact
b26fd06 Update to use artifact 2.2.2 package
65c4c4a Merge pull request #662 from actions/yacaovsnc/add_variable_for_concurrency_a...
0207619 move files back to satisfy licensed ci
1ecca81 licensed cache updates
9742269 Expose env vars to controll concurrency and timeout
6f51ac0 Merge pull request #656 from bdehamer/bdehamer/artifact-digest
Additional commits viewable in compare view

Updates actions/github-script from 3 to 7

Release notes

Sourced from actions/github-script's releases.

v7.0.0

What's Changed

Add base-url option by @robandpdx in actions/github-script#429

Expose async-function argument type by @viktorlott in actions/github-script#402, see for details https://github.com/actions/github-script#use-scripts-with-jsdoc-support

Update dependencies and use Node 20 by @joshmgross in actions/github-script#425

New Contributors

@navarroaxel made their first contribution in actions/github-script#285

@robandpdx made their first contribution in actions/github-script#429

@viktorlott made their first contribution in actions/github-script#402

Full Changelog: actions/github-script@v6.4.1...v7.0.0

v6.4.1

What's Changed

Add @octokit/plugin-request-log, to produce debug output for requests by @mjpieters in actions/github-script#358

fix input handling by @mjpieters in actions/github-script#357

Remove unused dependencies by @mjpieters in actions/github-script#356

Default debug to current runner debug state by @mjpieters in actions/github-script#363

New Contributors

@mjpieters made their first contribution in actions/github-script#358

Full Changelog: actions/github-script@v6.4.0...v6.4.1

v6.4.0

What's Changed

Bump json5 from 2.1.3 to 2.2.3 by @dependabot in actions/github-script#319

Bump minimatch from 3.0.4 to 3.1.2 by @dependabot in actions/github-script#320

Add node-fetch by @danmichaelo in actions/github-script#321

New Contributors

@jongwooo made their first contribution in actions/github-script#313

@austinvazquez made their first contribution in actions/github-script#306

@danmichaelo made their first contribution in actions/github-script#321

Full Changelog: actions/github-script@v6.3.3...v6.4.0

v6.3.3

What's Changed

Update @actions/glob to 0.3.0 by @nineinchnick in actions/github-script#279

New Contributors

@nineinchnick made their first contribution in actions/github-script#279

Full Changelog: actions/github-script@v6.3.2...v6.3.3

v6.3.2

What's Changed

Update @actions/core to 1.10.0 by @rentziass in actions/github-script#295

... (truncated)

Commits

60a0d83 Merge pull request #440 from actions/joshmgross/v7.0.1
b7fb200 Update version to 7.0.1
12e22ed Merge pull request #439 from actions/joshmgross/avoid-setting-base-url
d319f8f Avoid setting baseUrl to undefined when input is not provided
e69ef54 Merge pull request #425 from actions/joshmgross/node-20
ee0914b Update licenses
d6fc56f Use @types/node for Node 20
384d6cf Fix quotations in tests
8472492 Only validate GraphQL previews
84903f5 Remove node-fetch from type
Additional commits viewable in compare view

Updates actions/labeler from 4 to 5

Release notes

Sourced from actions/labeler's releases.

v5.0.0

What's Changed

This release contains the following breaking changes:

The ability to apply labels based on the names of base and/or head branches was added (#186 and #54). The match object for changed files was expanded with new combinations in order to make it more intuitive and flexible (#423 and #101). As a result, the configuration file structure was significantly redesigned and is not compatible with the structure of the previous version. Please read the action documentation to find out how to adapt your configuration files for use with the new action version.

The bug related to the sync-labels input was fixed (#112). Now the input value is read correctly.

By default, dot input is set to true. Now, paths starting with a dot (e.g. .github) are matched by default.

Version 5 of this action updated the runtime to Node.js 20. All scripts are now run with Node.js 20 instead of Node.js 16 and are affected by any breaking changes between Node.js 16 and 20.

For more information, please read the action documentation.

New Contributors

@joshdales made their first contribution in actions/labeler#203

@dusan-trickovic made their first contribution in actions/labeler#626

@sungh0lim made their first contribution in actions/labeler#630

@TrianguloY made their first contribution in actions/labeler#629

Full Changelog: actions/labeler@v4...v5.0.0

v5.0.0-beta.1

What's Changed

In scope of this beta release, the structure of the configuration file (.github/labeler.yml) was changed from
LabelName:
- any:
  - changed-files: ['list', 'of', 'globs']
  - base-branch: ['list', 'of', 'regexps']
  - head-branch: ['list', 'of', 'regexps']
- all:
  - changed-files: ['list', 'of', 'globs']
  - base-branch: ['list', 'of', 'regexps']
  - head-branch: ['list', 'of', 'regexps']
to
LabelName:
- any:
  - changed-files: 
    - AnyGlobToAnyFile: ['list', 'of', 'globs']
    - AnyGlobToAllFiles: ['list', 'of', 'globs']
    - AllGlobsToAnyFile: ['list', 'of', 'globs']
    - AllGlobsToAllFiles: ['list', 'of', 'globs']
  - base-branch: ['list', 'of', 'regexps']
  - head-branch: ['list', 'of', 'regexps']
- all:
  - changed-files:
    - AnyGlobToAnyFile: ['list', 'of', 'globs']
    - AnyGlobToAllFiles: ['list', 'of', 'globs']
    - AllGlobsToAnyFile: ['list', 'of', 'globs']
</tr></table> 

... (truncated)

Commits

8558fd7 Merge pull request #709 from actions/v5.0.0-beta
000ca75 Merge pull request #700 from MaksimZhukov/apply-suggestions-and-update-docume...
cb66c2f Update dist
9181355 Apply suggestions for the beta vesrion and update the documentation
efe4c1c Merge pull request #699 from MaksimZhukov/update-node-runtime-and-dependencies
c0957ad Run Prettier
8dc8d18 Update Node.js version in reusable workflows
d0d0bbe Update documentation
1375c42 5.0.0
ab7411e Change version of Node.js runtime to node20
Additional commits viewable in compare view

Updates actions/attest-build-provenance from 1.0.0 to 2.2.3

Release notes

Sourced from actions/attest-build-provenance's releases.

v2.2.3

What's Changed

Pin actions/attest reference by commit SHA by @bdehamer in actions/attest-build-provenance#493

Full Changelog: actions/attest-build-provenance@v2.2.2...v2.2.3

v2.2.2

What's Changed

Bump predicate action from 1.1.4 to 1.1.5 by @bdehamer in actions/attest-build-provenance#485

Bump @actions/attest from 1.5.0 to 1.6.0 by @bdehamer in actions/attest-build-provenance#484

Update buildSLSAProvenancePredicate to populate workflow.ref field from the ref claim in the OIDC token (actions/toolkit#1969)

Full Changelog: actions/attest-build-provenance@v2.2.1...v2.2.2

v2.2.1

What's Changed

Bump undici from 5.28.4 to 5.28.5 by @dependabot in actions/attest-build-provenance#457

Bump @octokit/request-error from 5.0.1 to 5.1.1 by @dependabot in actions/attest-build-provenance#469

Bump @octokit/request from 8.2.0 to 8.4.1 by @dependabot in actions/attest-build-provenance#478

Bump actions/attest from 2.2.0 to 2.2.1 by @bdehamer in actions/attest-build-provenance#481

Includes @actions/attest v1.6.0

Full Changelog: actions/attest-build-provenance@v2.2.0...v2.2.1

v2.2.0

What's Changed

Bump actions/attest from v2.1.0 to v2.2.0 by @bdehamer in actions/attest-build-provenance#449

Includes support for now subject-checksums input parameter

Full Changelog: actions/attest-build-provenance@v2.1.0...v2.2.0

v2.1.0

What's Changed

Update README w/ note about GH plans supporting attestations by @bdehamer in actions/attest-build-provenance#414

Add attestation-id and attestation-url outputs by @bdehamer in actions/attest-build-provenance#415

Full Changelog: actions/attest-build-provenance@v2.0.1...v2.1.0

v2.0.1

What's Changed

Bump actions/attest from 2.0.0 to 2.0.1 by @bdehamer in actions/attest-build-provenance#406

Deduplicate subjects before adding to in-toto statement

Full Changelog: actions/attest-build-provenance@v2.0.0...v2.0.1

v2.0.0

... (truncated)

Commits

c074443 pin actions/attest reference by commit sha (#493)
bd77c07 bump predicate from 1.1.4 to 1.1.5 (#485)
1176ef5 bump @actions/attest from 1.5.0 to 1.6.0 (#484)
f9eaf23 Bump actions/attest from 2.2.0 to 2.2.1 (#481)
f1321ec Bump @octokit/request from 8.2.0 to 8.4.1 (#478)
d8181f5 Bump the npm-development group with 6 updates (#476)
1f22f30 Bump @octokit/request-error from 5.0.1 to 5.1.1 (#469)
6e5e68c Bump the npm-development group with 4 updates (#471)
555f5b7 Bump the npm-development group with 6 updates (#465)
2d4fa84 Bump the npm-development group with 2 updates (#461)
Additional commits viewable in compare view

Updates ossf/scorecard-action from 2.3.1 to 2.4.1

Release notes

Sourced from ossf/scorecard-action's releases.

v2.4.1

What's Changed

This update bumps the Scorecard version to the v5.1.1 release. For a complete list of changes, please refer to the v5.1.0 and v5.1.1 release notes.

Publishing results now uses half the API quota as before. The exact savings depends on the repository in question.

use Scorecard library entrypoint instead of Cobra hooking by @spencerschrock in ossf/scorecard-action#1423

Some errors were made into annotations to make them more visible

Make default branch error more prominent by @jsoref in ossf/scorecard-action#1459

There is now an optional file_mode input which controls how repository files are fetched from GitHub. The default is archive, but git produces the most accurate results for repositories with .gitattributes files at the cost of analysis speed.

add input for specifying --file-mode by @spencerschrock in ossf/scorecard-action#1509

The underlying container for the action is now hosted on GitHub Container Registry. There should be no functional changes.

🌱 publish docker images to GitHub Container Registry by @spencerschrock in ossf/scorecard-action#1453

Docs

Installation docs update by @JeremiahAHoward in ossf/scorecard-action#1416

New Contributors

@JeremiahAHoward made their first contribution in ossf/scorecard-action#1416

@jsoref made their first contribution in ossf/scorecard-action#1459 Full Changelog: ossf/scorecard-action@v2.4.0...v2.4.1

v2.4.0

What's Changed

This update bumps the Scorecard version to the v5 release. For a complete list of changes, please refer to the v5.0.0 release notes. Of special note to Scorecard Action is the Maintainer Annotation feature, which can be used to suppress some Code Scanning false positives. Alerts will not be generated for any Scorecard Check with an annotation.

🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0 by @spencerschrock in ossf/scorecard-action#1410

🐛 lower license sarif alert threshold to 9 by @spencerschrock in ossf/scorecard-action#1411

Documentation

docs: dogfooding badge by @jkowalleck in ossf/scorecard-action#1399

New Contributors

@jkowalleck made their first contribution in ossf/scorecard-action#1399

Full Changelog: ossf/scorecard-action@v2.3.3...v2.4.0

v2.3.3

[!NOTE]
There is no v2.3.2 release as a step was skipped in the release process. This was fixed and re-released under the v2.3.3 tag

What's Changed

🌱 Bump github.com/ossf/scorecard/v4 (v4.13.1) to github.com/ossf/scorecard/v5 (v5.0.0-rc1) by @spencerschrock in ossf/scorecard-action#1366

🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc1 to v5.0.0-rc2 by @spencerschrock in ossf/scorecard-action#1374

🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0-rc2.0.20240509182734-7ce860946928 by @spencerschrock in ossf/scorecard-action#1377

For a full changelist of what these include, see the v5.0.0-rc1 and v5.0.0-rc2 release notes.

Documentation

📖 Move token discussion out of main README. by @spencerschrock in ossf/scorecard-action#1279

... (truncated)

Commits

f49aabe bump docker to ghcr v2.4.1 (#1478)
30a595b 🌱 Bump github.com/sigstore/cosign/v2 from 2.4.2 to 2.4.3 (#1515)
69ae593 omit vcs info from build (#1514)
6a62a1c add input for specifying --file-mode (#1509)
2722664 🌱 Bump the github-actions group with 2 updates (#1510)
ae0ef31 🌱 Bump github.com/spf13/cobra from 1.8.1 to 1.9.1 (#1512)
3676bbc 🌱 Bump golang from 1.23.6 to 1.24.0 in the docker-images group (#1513)
ae7548a Limit codeQL push trigger to main branch (#1507)
9165624 upgrade scorecard to v5.1.0 (#1508)
620fd28 🌱 Bump the github-actions group with 2 updates (#1505)
Additional commits viewable in compare view

Updates github/codeql-action from 2.2.4 to 3.28.13

Release notes

Sourced from github/codeql-action's releases.

v3.28.13

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.13 - 24 Mar 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.28.12

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.12 - 19 Mar 2025

Dependency caching should now cache more dependencies for Java build-mode: none extractions. This should speed up workflows and avoid inconsistent alerts in some cases.

Update default CodeQL bundle version to 2.20.7. #2810

See the full CHANGELOG.md for more information.

v3.28.11

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.11 - 07 Mar 2025

Update default CodeQL bundle version to 2.20.6. #2793

See the full CHANGELOG.md for more information.

v3.28.10

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.10 - 21 Feb 2025

Update default CodeQL bundle version to 2.20.5. #2772

Address an issue where the CodeQL Bundle would occasionally fail to decompress on macOS. #2768

See the full CHANGELOG.md for more information.

v3.28.9

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

3.28.13 - 24 Mar 2025

No user facing changes.

3.28.12 - 19 Mar 2025

Dependency caching should now cache more dependencies for Java build-mode: none extractions. This should speed up workflows and avoid inconsistent alerts in some cases.

Update default CodeQL bundle version to 2.20.7. #2810

3.28.11 - 07 Mar 2025

Update default CodeQL bundle version to 2.20.6. #2793

3.28.10 - 21 Feb 2025

Update default CodeQL bundle version to 2.20.5. #2772

Address an issue where the CodeQL Bundle would occasionally fail to decompress on macOS. #2768

3.28.9 - 07 Feb 2025

Update default CodeQL bundle version to 2.20.4. #2753

3.28.8 - 29 Jan 2025

Enable support for Kotlin 2.1.10 when running with CodeQL CLI v2.20.3. #2744

3.28.7 - 29 Jan 2025

No user facing changes.

3.28.6 - 27 Jan 2025

Re-enable debug artifact upload for CLI versions 2.20.3 or greater. #2726

3.28.5 - 24 Jan 2025

Update default CodeQL bundle version to 2.20.3. #2717

3.28.4 - 23 Jan 2025

No user facing changes.

... (truncated)

Commits

1b549b9 Merge pull request #2819 from github/update-v3.28.13-e0ea14102
82630c8 Update changelog for v3.28.13
e0ea141 Merge pull request #2818 from github/cklin/empty-pr-diff-range
b361a91 Diff-informed analysis: fix empty PR handling
bd1d9ab Merge pull request #2816 from github/cklin/overlay-file-list
b98ae6c Add overlay-database-utils tests
9825184 Add getFileOidsUnderPath() tests
ac67cff Merge pull request #2817 from github/cklin/default-setup-diff-informed
9c674ba build: refresh js files
d109dd5 Detect PR branches for Default Setup
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions group with 7 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `3.1.0` | `4.2.2` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `3.1.0` | `4.6.2` | | [actions/github-script](https://github.com/actions/github-script) | `3` | `7` | | [actions/labeler](https://github.com/actions/labeler) | `4` | `5` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `1.0.0` | `2.2.3` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.3.1` | `2.4.1` | | [github/codeql-action](https://github.com/github/codeql-action) | `2.2.4` | `3.28.13` | Updates `actions/checkout` from 3.1.0 to 4.2.2 - [Release notes](https://github.com/actions/checkout/releases) - [Commits](actions/checkout@v3.1.0...v4.2.2) Updates `actions/upload-artifact` from 3.1.0 to 4.6.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v3.1.0...v4.6.2) Updates `actions/github-script` from 3 to 7 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@v3...v7) Updates `actions/labeler` from 4 to 5 - [Release notes](https://github.com/actions/labeler/releases) - [Commits](actions/labeler@v4...v5) Updates `actions/attest-build-provenance` from 1.0.0 to 2.2.3 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@897ed5e...c074443) Updates `ossf/scorecard-action` from 2.3.1 to 2.4.1 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@0864cf1...f49aabe) Updates `github/codeql-action` from 2.2.4 to 3.28.13 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@17573ee...1b549b9) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/github-script dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/labeler dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/attest-build-provenance dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: ossf/scorecard-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot · 2025-04-01T22:12:25Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Apr 1, 2025

bcardosolopes closed this Apr 1, 2025

dependabot bot deleted the dependabot/github_actions/github-actions-5817e42a75 branch April 1, 2025 22:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the github-actions group with 7 updates #1541

Bump the github-actions group with 7 updates #1541

Uh oh!

dependabot bot commented on behalf of github Apr 1, 2025

Uh oh!

dependabot bot commented on behalf of github Apr 1, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Bump the github-actions group with 7 updates #1541

Bump the github-actions group with 7 updates #1541

Uh oh!

Conversation

dependabot bot commented on behalf of github Apr 1, 2025

v4.2.2

What's Changed

v4.2.1

What's Changed

New Contributors

v4.2.0

What's Changed

New Contributors

v4.1.7

What's Changed

New Contributors

v4.1.6

What's Changed

v4.1.5

What's Changed

v4.6.2

What's Changed

New Contributors

v4.6.1

What's Changed

v4.6.0

What's Changed

v4.5.0

What's Changed

New Contributors

v4.4.3

What's Changed

v4.4.2

What's Changed

v4.4.1

v7.0.0

What's Changed

New Contributors

v6.4.1

What's Changed

New Contributors

v6.4.0

What's Changed

New Contributors

v6.3.3

What's Changed

New Contributors

v6.3.2

What's Changed

v5.0.0

What's Changed

New Contributors

v5.0.0-beta.1

What's Changed

v2.2.3

What's Changed

v2.2.2

What's Changed

v2.2.1

What's Changed

v2.2.0

What's Changed

v2.1.0

What's Changed

v2.0.1

What's Changed

v2.0.0

v2.4.1

What's Changed

Docs

New Contributors

v2.4.0

What's Changed

Documentation

New Contributors

v2.3.3

What's Changed

Documentation

v3.28.13

CodeQL Action Changelog