ci(deps): bump the github-actions group across 1 directory with 12 updates by dependabot[bot] · Pull Request #83 · eclipse-csi/codesign-tools

dependabot · 2026-06-29T10:42:42Z

Bumps the github-actions group with 12 updates in the / directory:

Package	From	To
actions/checkout	`6.0.2`	`7.0.0`
zizmorcore/zizmor-action	`0.5.6`	`0.5.7`
github/codeql-action/upload-sarif	`4.36.0`	`4.36.2`
trufflesecurity/trufflehog	`3.95.3`	`3.95.6`
astral-sh/setup-uv	`8.1.0`	`8.2.0`
actions/setup-java	`5.2.0`	`5.3.0`
reviewdog/action-suggester	`1.24.0`	`1.24.3`
reviewdog/action-markdownlint	`0.26.2`	`0.27.0`
graalvm/setup-graalvm	`1.5.3`	`1.5.6`
github/codeql-action/init	`4.36.0`	`4.36.2`
github/codeql-action/autobuild	`4.36.0`	`4.36.2`
github/codeql-action/analyze	`4.36.0`	`4.36.2`

Updates actions/checkout from 6.0.2 to 7.0.0

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464

update error wording by @aiqiaoy in actions/checkout#2467

New Contributors

@aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

Update changelog by @ericsciple in actions/checkout#2357

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

Update changelog for v6.0.3 by @yaananth in actions/checkout#2446

New Contributors

@yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.0

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

... (truncated)

Commits

9c091bb update error wording (#2467)
1044a6d getting ready for checkout v7 release (#2464)
f028218 Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)
d914b26 upgrade module to esm and update dependencies (#2463)
537c7ef Bump @actions/core and @actions/tool-cache and Remove uuid (#2459)
130a169 Bump js-yaml from 4.1.0 to 4.2.0 (#2461)
7d09575 Bump flatted from 3.3.1 to 3.4.2 (#2460)
0f9f3aa Bump actions/publish-immutable-action (#2458)
f9e715a block checking out fork pr for pull_request_target and workflow_run (#2454)
df4cb1c Update changelog for v6.0.3 (#2446)
Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.5.6 to 0.5.7

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.5.7

1.26.1 is now available via the action 1.26.1 is now the default version of zizmor used by the action

Commits

192e21d Sync zizmor versions (#127)
2720f26 Update README.md with new actions/checkout version (#126)
40b41b8 chore(deps): bump the github-actions group with 2 updates (#123)
a687b25 chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0 in the github-ac...
64a6900 add note to explain that the default value for online-checks is different t...
14050ab chore(deps): bump the github-actions group with 2 updates (#118)
ee9b419 chore(deps): bump github/codeql-action in the github-actions group (#116)
fddf2b4 Bump pins in README (#115)
See full diff in compare view

Updates github/codeql-action/upload-sarif from 4.36.0 to 4.36.2

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.36.2

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

v4.36.1

No user facing changes.

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.36.2 - 04 Jun 2026

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837

Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850

Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853

Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795

The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789

Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794

Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807

Update default CodeQL bundle version to 2.25.2. #3823

... (truncated)

Commits

8aad20d Merge pull request #3949 from github/update-v4.36.2-dcb947ce1
f521b08 Add additional changelog notes
8aeff0f Update changelog for v4.36.2
dcb947c Merge pull request #3948 from github/update-bundle/codeql-bundle-v2.25.6
c251bce Add changelog note
62953c1 Update default bundle to codeql-bundle-v2.25.6
423b570 Merge pull request #3946 from github/dependabot/npm_and_yarn/npm-minor-5d507a...
c35d1b1 Merge pull request #3947 from github/dependabot/github_actions/dot-github/wor...
cb1a588 Merge pull request #3937 from github/robertbrignull/waitForProcessing_backoff
ba47406 Merge pull request #3943 from github/henrymercer/cache-cli-version-info
Additional commits viewable in compare view

Updates trufflesecurity/trufflehog from 3.95.3 to 3.95.6

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.95.6

What's Changed

Enigma detector enhance verification to prevent false verified findings by @shahzadhaider1 in trufflesecurity/trufflehog#5011

fix: scan files with lines exceeding bufio's default 64 KB token limit by @MuneebUllahKhan222 in trufflesecurity/trufflehog#5022

fix(postgres): honor ignore tags for default port URLs by @Dawn-Fighter in trufflesecurity/trufflehog#4968

Move to github.com/moby/moby/client from docker/docker by @trufflesteeeve in trufflesecurity/trufflehog#4987

fix: avoid terminal probes before CLI output by @Hackerchen716 in trufflesecurity/trufflehog#4994

Update test containers dependency by @trufflesteeeve in trufflesecurity/trufflehog#4978

Re-host pkg/handlers JSON test fixtures under the org by @amanfcp in trufflesecurity/trufflehog#5023

[INS-465] Add datadogapikey detector to defaults.go by @mustansir14 in trufflesecurity/trufflehog#4969

[INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @MuneebUllahKhan222 in trufflesecurity/trufflehog#5006

[INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @MuneebUllahKhan222 in trufflesecurity/trufflehog#5008

Updating Klaviyo PK new format by @breetan in trufflesecurity/trufflehog#5009

Restructure Klaviyo detector pattern tests by @martinlocklear in trufflesecurity/trufflehog#5026

Replace Renovate config with shared preset (high-risk tier) by @bryanbeverly in trufflesecurity/trufflehog#4992

set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @jordanTunstill in trufflesecurity/trufflehog#5027

GitHub finegrained analyzer was improperly handling errors by @dustin-decker in trufflesecurity/trufflehog#4498

[INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @MuneebUllahKhan222 in trufflesecurity/trufflehog#5005

Fix Renovate lookup: update setup-captain version comment by @bryanbeverly in trufflesecurity/trufflehog#4999

[INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @MuneebUllahKhan222 in trufflesecurity/trufflehog#5007

Fix: Resolve known dedup issues in notifierWorker by @MuneebUllahKhan222 in trufflesecurity/trufflehog#5028

fix(dropbox): prevent long sl.u. tokens from being truncated by @lukem-ts in trufflesecurity/trufflehog#5012

fix: add filetype=sdist param to pypi detector by @lukem-ts in trufflesecurity/trufflehog#4988

Handlers - Embed small HTTP test fixtures by @amanfcp in trufflesecurity/trufflehog#5001

S3: surface bucket listing failures and fix multi-role object count by @shahzadhaider1 in trufflesecurity/trufflehog#5035

New Contributors

@Dawn-Fighter made their first contribution in trufflesecurity/trufflehog#4968

@Hackerchen716 made their first contribution in trufflesecurity/trufflehog#4994

@breetan made their first contribution in trufflesecurity/trufflehog#5009

@lukem-ts made their first contribution in trufflesecurity/trufflehog#5012

Full Changelog: trufflesecurity/trufflehog@v3.95.4...v3.95.6

v3.95.5

What's Changed

[INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in trufflesecurity/trufflehog#4915

[INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in trufflesecurity/trufflehog#4907

fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in trufflesecurity/trufflehog#4958

Added GitLab OAuth Detector by @shahzadhaider1 in trufflesecurity/trufflehog#4729

Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in trufflesecurity/trufflehog#4761

[INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in trufflesecurity/trufflehog#4770

[INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in trufflesecurity/trufflehog#4803

fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in trufflesecurity/trufflehog#4954

Automate corpora testing in CI by @mustansir14 in trufflesecurity/trufflehog#4927

Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in trufflesecurity/trufflehog#4924

feat: add host, db and username to ExtraData for database detectors by @mariocj89 in trufflesecurity/trufflehog#4849

Remove over speculation from Corpora CI workflow by @mustansir14 in trufflesecurity/trufflehog#4974

Fix line numbers for duplicate secrets within a chunk by @amanfcp in trufflesecurity/trufflehog#4910

Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in trufflesecurity/trufflehog#4961

... (truncated)

Commits

30d5bb9 S3: surface bucket listing failures and fix multi-role object count (#5035)
f0739f1 close todo - embed small HTTP test fixtures (#5001)
36d680a add filetype=sdist param so we get the correct response code (#4988)
248ffd5 fix(dropbox): prevent long sl.u. tokens from being truncated before verificat...
afbdaa8 Fix: Resolve known dedup issues in notifierWorker (#5028)
7bcf376 [INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat fla...
84a2b33 Fix Renovate lookup: update setup-captain version comment (#4999)
ac0805e [INS-469] Added Rev detectors to defaults.go and gated it behind feature flag...
d03d087 GitHub finegrain analyzer was improperly handling errors (#4498)
b64cefe set redacted value to last 4 characters of secret, to match how the secret ty...
Additional commits viewable in compare view

Updates astral-sh/setup-uv from 8.1.0 to 8.2.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v8.2.0 🌈 New inputs quiet and download-from-astral-mirror

Changes

This release brings two new inputs and a few bug fixes.

New inputs

Lets talk about the new inputs first.

quiet

Pretty simple. It turns of all info loggings. Useful if you use this in a composite action and are not interested in all the details. In the upcoming releases we will add log groups to fully implement support for "less noise"

[!NOTE]
Warnings and errors are always logged.

download-from-astral-mirror

In some cases you may want to directly use the fallback of checking for available versions and downloading releases from GitHub instead of using the astral.sh mirror. Setting download-from-astral-mirror: false allows you to do that.

Bugfixes

When using the astral.sh mirror to query available versions and download releases (done by default) we now stop sending the GitHub token in the header. The mirror never looked at it but we shouldn't be handing out that data even if it is just a short lived token. All other bugfixes try to limit the impact of failed GitHub queries due to retries and other faults.

We couldn't pinpoint all rootcauses yet but added more logging for error cases to track them down.

🐛 Bug fixes

fix: report unexpected cache save failures @eifinger (#896)

fix: report unexpected setup failures @eifinger (#895)

fix: add timeout to fetch to prevent silent hangs @eifinger-bot (#883)

Limit GitHub tokens to github.com download URLs @zsol (#878)

increase libuv-workaround timeout to 100ms @eifinger (#880)

🚀 Enhancements

Add quiet input to suppress info-level log output @eifinger (#898)

feat: add download-from-astral-mirror input @eifinger (#897)

🧰 Maintenance

docs: update dependabot rollup biome guidance @eifinger (#902)

chore: update known checksums for 0.11.18 @github-actions[bot] (#899)

chore: update known checksums for 0.11.17 @github-actions[bot] (#892)

chore: update known checksums for 0.11.16 @github-actions[bot] (#889)

chore: update known checksums for 0.11.15 @github-actions[bot] (#885)

chore: update known checksums for 0.11.14 @github-actions[bot] (#879)

chore: update known checksums for 0.11.13 @github-actions[bot] (#877)

... (truncated)

Commits

fac544c chore(deps): roll up dependabot updates (#903)
7390f77 docs: update dependabot rollup biome guidance (#902)
363c64a chore(deps): roll up dependabot updates (#901)
c4fcbaf chore(deps): bump release-drafter/release-drafter from 7.3.0 to 7.3.1 (#900)
8e642c5 chore: update known checksums for 0.11.18 (#899)
a92cb43 Add quiet input to suppress info-level log output (#898)
e07f2ac chore(deps): bump eifinger/actionlint-action from 1.10.1 to 1.10.2 (#842)
bc4034e chore(deps): bump github/codeql-action from 4.35.4 to 4.36.0 (#893)
df42d4f chore(deps): bump zizmorcore/zizmor-action from 0.5.5 to 0.5.6 (#891)
b9c8c4c feat: add download-from-astral-mirror input (#897)
Additional commits viewable in compare view

Updates actions/setup-java from 5.2.0 to 5.3.0

Release notes

Sourced from actions/setup-java's releases.

v5.3.0

What's Changed

chore: update Java version to 25 in setup examples by @alaahong in actions/setup-java#969

Bump minimatch from 3.1.2 to 3.1.5 by @dependabot[bot] in actions/setup-java#984

Refactor error handling and improve test logging for installers by @chiranjib-swain in actions/setup-java#989

chore: upgrade dependencies (@actions/core, cache, glob, http-client, tool-cache, xmlbuilder2) by @Copilot in actions/setup-java#999

Add Oracle JDK 17 licensing limitation note by @mahabaleshwars in actions/setup-java#1001

Update readme for ubuntu sudo java_home behavior by @mahabaleshwars in actions/setup-java#1013

temurin: add support for Alpine Linux by @gdams in actions/setup-java#674

fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parser by @gdams in actions/setup-java#1015

Bump @typescript-eslint/eslint-plugin from 8.35.1 to 8.48.0 by @dependabot[bot] in actions/setup-java#952

Bump eslint-config-prettier from 8.10.0 to 10.1.8 by @dependabot[bot] in actions/setup-java#881

Bump picomatch, @types/jest, jest, jest-circus and ts-jest by @dependabot[bot] in actions/setup-java#1016

Bump @types/node from 24.1.0 to 25.9.3 by @dependabot[bot] in actions/setup-java#950

Implement pagination with link headers for Adoptium based apis by @johnoliver in actions/setup-java#1014

Make the Adoptopenjdk package type look at the Temurin repo first for latest assets by @johnoliver in actions/setup-java#522

Bump @vercel/ncc from 0.38.1 to 0.44.0 by @dependabot[bot] in actions/setup-java#1018

New Contributors

@alaahong made their first contribution in actions/setup-java#969

@Copilot made their first contribution in actions/setup-java#999

@johnoliver made their first contribution in actions/setup-java#1014

Full Changelog: actions/setup-java@v5...v5.3.0

Commits

ad2b381 Bump @vercel/ncc from 0.38.1 to 0.44.0 (#1018)
b24df5b Make the Adoptopenjdk package type look at the Temurin repo first for latest ...
43120bc Implement pagination with link headers for Adoptium based apis (#1014)
ad9d6a6 Bump @types/node from 24.1.0 to 25.9.3 (#950)
039af37 Bump picomatch, @types/jest, jest, jest-circus and ts-jest (#1016)
1756ab6 Bump eslint-config-prettier from 8.10.0 to 10.1.8 (#881)
662bb59 Bump @typescript-eslint/eslint-plugin from 8.35.1 to 8.46.2 (#952)
1071fc1 fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parse...
576b821 Merge pull request #674 from gdams/alpine
307d3a2 update readme for ubuntu sudo java_home behavior (#1013)
Additional commits viewable in compare view

Updates reviewdog/action-suggester from 1.24.0 to 1.24.3

Release notes

Sourced from reviewdog/action-suggester's releases.

Release v1.24.3

What's Changed

chore(deps): update dependency go to 1.26 by @renovate[bot] in reviewdog/action-suggester#112

Full Changelog: reviewdog/action-suggester@v1.24.2...v1.24.3

Release v1.24.2

What's Changed

chore(deps): update reviewdog/action-misspell action to v1.27.0 by @renovate[bot] in reviewdog/action-suggester#106

chore(deps): update reviewdog/action-setup action to v1.5.0 by @renovate[bot] in reviewdog/action-suggester#108

chore(deps): update actions/setup-go action to v6.4.0 by @renovate[bot] in reviewdog/action-suggester#109

Full Changelog: reviewdog/action-suggester@v1.24.1...v1.24.2

Release v1.24.1

What's Changed

fix the version name of action.yml by @shogo82148 in reviewdog/action-suggester#104

chore(deps): update reviewdog/action-actionlint action to v1.67.0 by @renovate[bot] in reviewdog/action-suggester#96

chore(deps): update reviewdog/action-shellcheck action to v1.32.0 by @renovate[bot] in reviewdog/action-suggester#97

chore(deps): update actions/setup-go action to v6 by @renovate[bot] in reviewdog/action-suggester#99

chore(deps): update haya14busa/action-update-semver action to v1.5.1 by @renovate[bot] in reviewdog/action-suggester#102

chore(deps): update actions/checkout action to v7 by @renovate[bot] in reviewdog/action-suggester#114

chore(deps): update reviewdog/action-actionlint action to v1.72.0 by @renovate[bot] in reviewdog/action-suggester#105

Full Changelog: reviewdog/action-suggester@v1.24.0...v1.24.1

Commits

2558ba1 Merge pull request #112 from reviewdog/renovate/go-1.x
344d690 Merge pull request #109 from reviewdog/renovate/actions-setup-go-6.x
eaae686 Merge pull request #108 from reviewdog/renovate/reviewdog-action-setup-1.x
0a13364 Merge pull request #106 from reviewdog/renovate/reviewdog-action-misspell-1.x
604cbc1 Merge pull request #105 from reviewdog/renovate/reviewdog-action-actionlint-1.x
50c0a5e chore(deps): update reviewdog/action-misspell action to v1.27.0
d5e0f41 chore(deps): update reviewdog/action-actionlint action to v1.72.0
f32de73 chore(deps): update actions/setup-go action to v6.4.0
2338685 Merge pull request #114 from reviewdog/renovate/actions-checkout-7.x
9dc1d8b chore(deps): update actions/checkout action to v7
Additional commits viewable in compare view

Updates reviewdog/action-markdownlint from 0.26.2 to 0.27.0

Release notes

Sourced from reviewdog/action-markdownlint's releases.

Release v0.27.0

v0.27.0: PR #69 - chore(deps): update reviewdog to 0.21.0

Commits

844fd04 Merge pull request #69 from reviewdog/depup/reviewdog
3f1f661 Merge pull request #66 from reviewdog/depup/markdownlint-cli
3150235 chore(deps): update reviewdog to 0.21.0
e818a0c chore(deps): update markdownlint-cli to 0.49.0
ed88f9c Merge pull request #86 from reviewdog/renovate/haya14busa-action-depup-1.x
7b69fbf Merge pull request #84 from reviewdog/renovate/peter-evans-create-pull-reques...
9aa07ef Merge pull request

…dates Bumps the github-actions group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.0` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.6` | `0.5.7` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.36.0` | `4.36.2` | | [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) | `3.95.3` | `3.95.6` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `8.1.0` | `8.2.0` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.2.0` | `5.3.0` | | [reviewdog/action-suggester](https://github.com/reviewdog/action-suggester) | `1.24.0` | `1.24.3` | | [reviewdog/action-markdownlint](https://github.com/reviewdog/action-markdownlint) | `0.26.2` | `0.27.0` | | [graalvm/setup-graalvm](https://github.com/graalvm/setup-graalvm) | `1.5.3` | `1.5.6` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.0` | `4.36.2` | | [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.36.0` | `4.36.2` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.0` | `4.36.2` | Updates `actions/checkout` from 6.0.2 to 7.0.0 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...9c091bb) Updates `zizmorcore/zizmor-action` from 0.5.6 to 0.5.7 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@5f14fd0...192e21d) Updates `github/codeql-action/upload-sarif` from 4.36.0 to 4.36.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@7211b7c...8aad20d) Updates `trufflesecurity/trufflehog` from 3.95.3 to 3.95.6 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...30d5bb9) Updates `astral-sh/setup-uv` from 8.1.0 to 8.2.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) Updates `actions/setup-java` from 5.2.0 to 5.3.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@be666c2...ad2b381) Updates `reviewdog/action-suggester` from 1.24.0 to 1.24.3 - [Release notes](https://github.com/reviewdog/action-suggester/releases) - [Commits](reviewdog/action-suggester@aa38384...2558ba1) Updates `reviewdog/action-markdownlint` from 0.26.2 to 0.27.0 - [Release notes](https://github.com/reviewdog/action-markdownlint/releases) - [Commits](reviewdog/action-markdownlint@3667398...844fd04) Updates `graalvm/setup-graalvm` from 1.5.3 to 1.5.6 - [Release notes](https://github.com/graalvm/setup-graalvm/releases) - [Commits](graalvm/setup-graalvm@bef4b0e...6f3fa03) Updates `github/codeql-action/init` from 4.36.0 to 4.36.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@7211b7c...8aad20d) Updates `github/codeql-action/autobuild` from 4.36.0 to 4.36.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@7211b7c...8aad20d) Updates `github/codeql-action/analyze` from 4.36.0 to 4.36.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@7211b7c...8aad20d) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.5.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/setup-java dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: reviewdog/action-suggester dependency-version: 1.24.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: reviewdog/action-markdownlint dependency-version: 0.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: graalvm/setup-graalvm dependency-version: 1.5.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/autobuild dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the dependencies This issue or pull request is about third-party dependencies label Jun 29, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci(deps): bump the github-actions group across 1 directory with 12 updates#83

ci(deps): bump the github-actions group across 1 directory with 12 updates#83
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-d753e20f2a

dependabot Bot commented on behalf of github Jun 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 29, 2026

v7.0.0

What's Changed

New Contributors

v6.0.3

What's Changed

New Contributors

Changelog

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v0.5.7

v4.36.2

v4.36.1

CodeQL Action Changelog

[UNRELEASED]

4.36.2 - 04 Jun 2026

4.36.1 - 02 Jun 2026

4.36.0 - 22 May 2026

4.35.5 - 15 May 2026

4.35.4 - 07 May 2026

4.35.3 - 01 May 2026

4.35.2 - 15 Apr 2026

v3.95.6

What's Changed

New Contributors

v3.95.5

What's Changed

v8.2.0 🌈 New inputs quiet and download-from-astral-mirror

Changes

New inputs

quiet

download-from-astral-mirror

Bugfixes

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

v5.3.0

What's Changed

New Contributors

Release v1.24.3

What's Changed

Release v1.24.2

What's Changed

Release v1.24.1

What's Changed

Release v0.27.0

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

v8.2.0 🌈 New inputs `quiet` and `download-from-astral-mirror`