Skip to content

Bump the github-dependencies group with 7 updates#346

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/github-dependencies-54396615ac
Closed

Bump the github-dependencies group with 7 updates#346
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/github-dependencies-54396615ac

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 28, 2026

Bumps the github-dependencies group with 7 updates:

Package From To
actions/checkout 4 6
actions/setup-java 4 5
gradle/gradle-build-action 2.12.0 3.5.0
JetBrains/qodana-action 2023.3.1 2025.3.1
github/codeql-action 3 4
gradle/wrapper-validation-action 1 3
gradle-update/update-gradle-wrapper-action 1 2

Updates actions/checkout from 4 to 6

Release notes

Sourced from actions/checkout's releases.

v6.0.0

What's Changed

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.1

What's Changed

Full Changelog: actions/checkout@v4...v4.3.1

v4.3.0

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

... (truncated)

Commits

Updates actions/setup-java from 4 to 5

Release notes

Sourced from actions/setup-java's releases.

v5.0.0

What's Changed

Breaking Changes

Make sure your runner is updated to this version or newer to use this release. v2.327.1 Release Notes

Dependency Upgrades

Bug Fixes

New Contributors

Full Changelog: actions/setup-java@v4...v5.0.0

v4.8.0

What's Changed

Full Changelog: actions/setup-java@v4...v4.8.0

v4.7.1

What's Changed

Documentation changes

Dependency updates:

Full Changelog: actions/setup-java@v4...v4.7.1

v4.7.0

What's Changed

... (truncated)

Commits
  • be666c2 Chore: Version Update and Checkout Update to v6 (#973)
  • f7a6fef Bump actions/checkout from 5 to 6 (#961)
  • d81c4e4 Upgrade @​actions/cache to v5 (#968)
  • 1b1bbe1 readme update (#972)
  • 5d7b214 Retry on HTTP 522 Connection timed out (#964)
  • f2beeb2 Bump actions/publish-action from 0.3.0 to 0.4.0 (#912)
  • 4e7e684 feat: Add support for .sdkmanrc file in java-version-file parameter (#736)
  • 46c56d6 Add GitHub Token Support for GraalVM and Refactor Code (#849)
  • 66b9457 Update SapMachine URLs (#955)
  • 6ba5449 Enhance error logging for network failures to include endpoint/IP details, ad...
  • Additional commits viewable in compare view

Updates gradle/gradle-build-action from 2.12.0 to 3.5.0

Release notes

Sourced from gradle/gradle-build-action's releases.

v3.5.0

[!IMPORTANT] As of v3 this action has been superceded by gradle/actions/setup-gradle. Any workflow that uses gradle/gradle-build-action@v3 will transparently delegate to gradle/actions/setup-gradle@v3.

Users are encouraged to update their workflows, replacing:

uses: gradle/gradle-build-action@v3

with

uses: gradle/actions/setup-gradle@v3

See the setup-gradle documentation for up-to-date documentation for gradle/actions/setup-gradle.

For release details, see https://github.com/gradle/actions/releases/tag/v3.5.0

v3.4.2

[!IMPORTANT] As of v3 this action has been superceded by gradle/actions/setup-gradle. Any workflow that uses gradle/gradle-build-action@v3 will transparently delegate to gradle/actions/setup-gradle@v3.

Users are encouraged to update their workflows, replacing:

uses: gradle/gradle-build-action@v3

with

uses: gradle/actions/setup-gradle@v3

See the setup-gradle documentation for up-to-date documentation for gradle/actions/setup-gradle.

For release details, see https://github.com/gradle/actions/releases/tag/v3.4.2

v3.4.1

[!IMPORTANT] As of v3 this action has been superceded by gradle/actions/setup-gradle. Any workflow that uses gradle/gradle-build-action@v3 will transparently delegate to gradle/actions/setup-gradle@v3.

Users are encouraged to update their workflows, replacing:

uses: gradle/gradle-build-action@v3

with

... (truncated)

Commits

Updates JetBrains/qodana-action from 2023.3.1 to 2025.3.1

Release notes

Sourced from JetBrains/qodana-action's releases.

v2025.3.1

Changelog

  • 3b96197 ⬆️ Update qodana to v2025.3.1
  • 42dad39 ⬆️ Update Qodana Azure version to 2025.3.1

v2025.2.4

Changelog

  • e2d8059 🐛 QD-13112 fix ignore of ignoreReturnCode option in git operations
  • 99ec27a QD-13112 bump version for azure

v2025.2.3

Changelog

  • caabf6f ⬆️ Bump azure-devops-node-api from 14.1.0 to 15.1.0
  • 1374d44 🧱 Update vsts/QodanaScan/index.js
  • 3d4f50e ✨ add more logging around git operations
  • 785712e ⬆️ Bump actions/checkout from 5 to 6 in the dependencies group
  • 8d427a3 ⬆️ Update qodana to v2025.2.3

v2025.2.2

Changelog

  • 99bb9c6 🐛 QD-12042 add fallback when pr-sha is calculated and fix parsing
  • c42bca8 🐛 QD-12042 change wording a little bit
  • ab05ceb 🧱 Update vsts/QodanaScan/index.js
  • d766674 🐛 QD-11047 Allow code gl artifact upload
  • 986309f 🐛 Add system token to Azure git commands and fix action tests (#526)
  • 1c1fbc2 🐛 fix property arg parsing (make it according to doc) + add tests (#528)
  • 2374145 🐛 QD-12128 pass access token directly
  • 1835cfb ✨ QD-12128 add workingDirectory property
  • 8862093 🐛 Fix a patch version in the Azure task
  • 0bde661 ⬆️ Bump the dependencies group across 1 directory with 4 updates
  • 3187f6a ⬆️ Bump the dependencies group across 1 directory with 16 updates
  • 599e8b3 🧱 Update scan/dist/index.js
  • 11c5139 ⬆️ Update qodana to v2025.2.2 (#534)
  • 1725ecf ⬆️ Bump js-yaml from 4.1.0 to 4.1.1 (#536)
  • cd5f7b3 📝 Update release instructions in CONTRIBUTING.md
  • 6dfd39d ⬆️ Bump js-yaml in /common
  • 3c7604d ⬆️ Bump brace-expansion from 1.1.11 to 1.1.12 (#540)
  • 2cbdbde ⬆️ Bump axios from 1.9.0 to 1.12.0 in /gitlab
  • e5d20b1 ⬆️ Bump jest and @​types/jest

v2025.2.1

Changelog

  • db438bd 🐛 QD-11047 fix issue with quick-fixes: brunch and pr-mode: false (#479)
  • 6162bc6 🐛 QD-11047 fix issue with quick-fixes in gitlab in branch mode (#482)
  • 6dfb15c ⬆️ Bump the dependencies group across 1 directory with 7 updates
  • ed82547 🧱 Update scan/dist/index.js
  • 127bb0b ⬆️ Bump @​octokit/types from 13.10.0 to 14.0.0
  • 9f3c5cf 🐛 QD-11709 Support a list of values for --property argument (#481)
  • 36a369f :feature: QD-11663 Azure: make a UI 'push quick-fixes' field a dropdown menu (#484)
  • 0eb994c ⬆️ Bump the dependencies group with 10 updates

... (truncated)

Commits
  • 42dad39 ⬆️ Update Qodana Azure version to 2025.3.1
  • 3b96197 ⬆️ Update qodana to v2025.3.1
  • 99ec27a QD-13112 bump version for azure
  • e2d8059 🐛 QD-13112 fix ignore of ignoreReturnCode option in git operations
  • 8d427a3 ⬆️ Update qodana to v2025.2.3
  • 785712e ⬆️ Bump actions/checkout from 5 to 6 in the dependencies group
  • 3d4f50e ✨ add more logging around git operations
  • 1374d44 🧱 Update vsts/QodanaScan/index.js
  • caabf6f ⬆️ Bump azure-devops-node-api from 14.1.0 to 15.1.0
  • e5d20b1 ⬆️ Bump jest and @​types/jest
  • Additional commits viewable in compare view

Updates github/codeql-action from 3 to 4

Release notes

Sourced from github/codeql-action's releases.

v3.32.0

  • Update default CodeQL bundle version to 2.24.0. #3425

v3.31.11

  • When running a Default Setup workflow with Actions debugging enabled, the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. #3409
  • Improved error handling throughout the CodeQL Action. #3415
  • Added experimental support for automatically excluding generated files from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. #3318
  • The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. #3403

v3.31.10

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.31.10 - 12 Jan 2026

  • Update default CodeQL bundle version to 2.23.9. #3393

See the full CHANGELOG.md for more information.

v3.31.9

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.31.9 - 16 Dec 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.31.8

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.31.8 - 11 Dec 2025

  • Update default CodeQL bundle version to 2.23.8. #3354

See the full CHANGELOG.md for more information.

v3.31.7

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.31.7 - 05 Dec 2025

  • Update default CodeQL bundle version to 2.23.7. #3343

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

4.31.11 - 23 Jan 2026

  • When running a Default Setup workflow with Actions debugging enabled, the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. #3409
  • Improved error handling throughout the CodeQL Action. #3415
  • Added experimental support for automatically excluding generated files from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. #3318
  • The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. #3403

4.31.10 - 12 Jan 2026

  • Update default CodeQL bundle version to 2.23.9. #3393

4.31.9 - 16 Dec 2025

No user facing changes.

4.31.8 - 11 Dec 2025

  • Update default CodeQL bundle version to 2.23.8. #3354

4.31.7 - 05 Dec 2025

  • Update default CodeQL bundle version to 2.23.7. #3343

4.31.6 - 01 Dec 2025

No user facing changes.

4.31.5 - 24 Nov 2025

  • Update default CodeQL bundle version to 2.23.6. #3321

4.31.4 - 18 Nov 2025

No user facing changes.

4.31.3 - 13 Nov 2025

  • CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see Upcoming deprecation of CodeQL Action v3.
  • Update default CodeQL bundle version to 2.23.5. #3288

4.31.2 - 30 Oct 2025

No user facing changes.

4.31.1 - 30 Oct 2025

  • The add-snippets input has been removed from the analyze action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.

4.31.0 - 24 Oct 2025

... (truncated)

Commits
  • 9469107 Update changelog for v4.31.11
  • 1601acf Merge pull request #3415 from github/henrymercer/address-telemetry-gap
  • fba7872 Address review comments
  • a8dd5ab Merge pull request #3414 from github/dependabot/npm_and_yarn/lodash-4.17.23
  • 28bfb7b Omit error from start-proxy Action
  • 91f3460 Throw if in test mode
  • edebb78 Differentiate unhandled errors in telemetry
  • 529c266 Use getErrorMessage in more places
  • 6bd84b6 Rename to "unhandled"
  • 5e98e18 Merge pull request #3410 from github/dependabot/npm_and_yarn/tar-7.5.6
  • Additional commits viewable in compare view

Updates gradle/wrapper-validation-action from 1 to 3

Release notes

Sourced from gradle/wrapper-validation-action's releases.

v2.1.3

What's Changed

  • Update various NPM dependencies
  • Update wrapper checksums to include Gradle 8.7

Full Changelog: gradle/wrapper-validation-action@v2.1.2...v2.1.3

v2.1.2

What's Changed

  • Update various NPM dependencies
  • Update wrapper checksums

Full Changelog: gradle/wrapper-validation-action@v2.1.1...v2.1.2

v2.1.1

Changelog

  • [FIX] Add hardcoded checksum for Gradle 7.6.4

Full Changelog: gradle/wrapper-validation-action@v2...v2.1.1

v2.1.0

This release should vastly reduce the number of network requests made by the wrapper-validation-action, by hardcoding the checksums of all known Gradle wrapper jars at time of release. With this improvement, a number of long-standing issues should be addressed (#164, #162, #57).

The action should now only make network requests to validate the checksums of an unknown gradle-wrapper.jar. This can happen if:

  • The Gradle version was published after this action was released
  • The gradle-wrapper.jar is truly invalid

Changelog

  • [NEW] Hardcode list of known checksums to avoid network requests in most cases (#161)

Huge thanks to @​Marcono1234 for contributing this long-awaited improvement.

v2.0.1

This patch release fixes error reporting when failing to retrieve the checksums from services.gradle.org

  • [FIX] After migration from v1 to v2 silently fails (#174)

v2.0.0

What's Changed

The version of the Node.js runtime was updated to 20, and the majority of dependencies were updated to the latest versions. From now on, the wrapper-validation-action will require a Node.js 20 runtime environment.

There are no functional changes in this release. This release is tagged with the v2 version label.

  • [NEW] Update Node.js runtime to version 20 (#170)

... (truncated)

Commits

Updates gradle-update/update-gradle-wrapper-action from 1 to 2

Release notes

Sourced from gradle-update/update-gradle-wrapper-action's releases.

Update Gradle Wrapper Action v2.0.0

No release notes provided.

Update Gradle Wrapper Action v1.0.20

No release notes provided.

Update Gradle Wrapper Action v1.0.19

No release notes provided.

Update Gradle Wrapper Action v1.0.18

No release notes provided.

Update Gradle Wrapper Action v1.0.17

No release notes provided.

Update Gradle Wrapper Action v1.0.16

No release notes provided.

Update Gradle Wrapper Action v1.0.15

No release notes provided.

Update Gradle Wrapper Action v1.0.14

No release notes provided.

Update Gradle Wrapper Action v1.0.13

  • Added base-branch input parameter.

Update Gradle Wrapper Action v1.0.12

  • repo-token input parameter is not mandatory anymore, and it defaults to GITHUB_TOKEN if not specified. Additionally, token authentication in git commands has been fixed.

Update Gradle Wrapper Action v1.0.11

v1.0.11

  • Added team-reviewers input parameter.
  • Added failure report (as PR comment) for reviewers assignment.

Update Gradle Wrapper Action v1.0.10

No release notes provided.

Update Gradle Wrapper Action v1.0.9

No release notes provided.

Update Gradle Wrapper Action v1.0.8

No release notes provided.

Update Gradle Wrapper Action v1.0.7

No release notes provided.

Update Gradle Wrapper Action v1.0.6

No release notes provided.

... (truncated)

Changelog

Sourced from gradle-update/update-gradle-wrapper-action's changelog.

v1.0.12

  • repo-token input parameter is not mandatory anymore, and it defaults to GITHUB_TOKEN if not specified. Additionally, token authentication in git commands has been fixed.
Commits
  • 512b187 Prepare changelog for v2.1.0 (#887)
  • 56ed2fe Bump @​typescript-eslint/eslint-plugin from 8.24.1 to 8.25.0 (#884)
  • a78c985 Bump prettier from 3.5.1 to 3.5.2 (#882)
  • cc24683 Add 'pr-message-template' input to allow setting custom PR message (#886)
  • ae11fbd Bump @​typescript-eslint/parser from 8.24.1 to 8.25.0 (#883)
  • 601ac00 Bump @​stylistic/eslint-plugin from 4.0.1 to 4.1.0 (#885)
  • dbef0df Bump eslint from 9.20.1 to 9.21.0 (#881)
  • 018f81f Bump ts-jest from 29.2.5 to 29.2.6 (#880)
  • 268550f Bump @​types/node from 22.13.4 to 22.13.5 (#879)
  • 462b127 Update @​actions/github to 6.0.0 (#878)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@smcvb
Copy link
Member

smcvb commented Jan 28, 2026

@dependabot rebase

Bumps the github-dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `6` |
| [actions/setup-java](https://github.com/actions/setup-java) | `4` | `5` |
| [gradle/gradle-build-action](https://github.com/gradle/gradle-build-action) | `2.12.0` | `3.5.0` |
| [JetBrains/qodana-action](https://github.com/jetbrains/qodana-action) | `2023.3.1` | `2025.3.1` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3` | `4` |
| [gradle/wrapper-validation-action](https://github.com/gradle/wrapper-validation-action) | `1` | `3` |
| [gradle-update/update-gradle-wrapper-action](https://github.com/gradle-update/update-gradle-wrapper-action) | `1` | `2` |


Updates `actions/checkout` from 4 to 6
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)

Updates `actions/setup-java` from 4 to 5
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@v4...v5)

Updates `gradle/gradle-build-action` from 2.12.0 to 3.5.0
- [Release notes](https://github.com/gradle/gradle-build-action/releases)
- [Commits](gradle/gradle-build-action@v2.12.0...v3.5.0)

Updates `JetBrains/qodana-action` from 2023.3.1 to 2025.3.1
- [Release notes](https://github.com/jetbrains/qodana-action/releases)
- [Commits](JetBrains/qodana-action@v2023.3.1...v2025.3.1)

Updates `github/codeql-action` from 3 to 4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v3...v4)

Updates `gradle/wrapper-validation-action` from 1 to 3
- [Release notes](https://github.com/gradle/wrapper-validation-action/releases)
- [Commits](gradle/wrapper-validation-action@v1...v3)

Updates `gradle-update/update-gradle-wrapper-action` from 1 to 2
- [Release notes](https://github.com/gradle-update/update-gradle-wrapper-action/releases)
- [Changelog](https://github.com/gradle-update/update-gradle-wrapper-action/blob/main/CHANGELOG.md)
- [Commits](gradle-update/update-gradle-wrapper-action@v1...v2)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-dependencies
- dependency-name: actions/setup-java
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-dependencies
- dependency-name: gradle/gradle-build-action
  dependency-version: 3.5.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-dependencies
- dependency-name: JetBrains/qodana-action
  dependency-version: 2025.3.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-dependencies
- dependency-name: github/codeql-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-dependencies
- dependency-name: gradle/wrapper-validation-action
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-dependencies
- dependency-name: gradle-update/update-gradle-wrapper-action
  dependency-version: '2'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/github_actions/github-dependencies-54396615ac branch from 2078a48 to f7025d4 Compare January 28, 2026 14:37
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Jan 28, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Jan 28, 2026
@dependabot dependabot bot deleted the dependabot/github_actions/github-dependencies-54396615ac branch January 28, 2026 16:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant