build(deps): Bump the github-actions group with 6 updates

[dependabot]

Bumps the github-actions group with 6 updates:

Package	From	To
sbomify/github-action	26.2.0	26.7.0
actions/attest	4.1.1	4.2.0
github/codeql-action/init	4.37.0	4.37.1
github/codeql-action/autobuild	4.37.0	4.37.1
github/codeql-action/analyze	4.37.0	4.37.1
github/codeql-action/upload-sarif	4.37.0	4.37.1

Updates sbomify/github-action from 26.2.0 to 26.7.0

Release notes

Sourced from sbomify/github-action's releases.

v26.7.0

Highlights

• Interactive setup wizard: a new Textual TUI (sbomify-action wizard, bundled in the Docker image) that scans your repo for lockfiles, signs you in to sbomify, registers matching components, and writes a release-ready .github/workflows/sboms.yml — with --dry-run support (#238, #240). Follow-ups add responsive terminal layouts, truecolor in Docker, per-ecosystem lockfile discovery, SHA-pinned action refs, and CalVer-aware tag dispatch (#247–#283).
• OIDC trusted publishing: authenticate uploads to sbomify with GitHub OIDC instead of long-lived tokens, and let the wizard auto-register the trusted publisher during apply (#235, #242).
• VEX, CBOM, and HBOM uploads: new BOM_TYPE setting uploads non-SBOM artifacts verbatim, accepting CycloneDX VEX, OpenVEX, and CSAF documents (#255, #265).
• Multi-arch Docker images: amd64 + arm64 images built natively per architecture, with ghcr.io as the primary registry and Docker Hub as the mirror (#226, #248, #275).
• Stricter failure semantics: post-upload processor errors and partial product-release tagging failures now fail the run instead of passing silently (#261, #272).
• Dependency-Track: expose the missing upload options (#230) — thanks @​Erik-Hoffmann for the first-time contribution!
• Enrichment & generation fixes: preserve versionless PURLs during enrichment (#229), drop --required-only for Go in cdxgen (#234), and get-or-create components on duplicate names (#236).
• Supply-chain hygiene: OpenGrep SAST in CI (#246), security patches for idna/urllib3/pip (#241), and bumped bundled SBOM tools (#274).

What's Changed

• Make ghcr.io the primary registry, Docker Hub the mirror by @​vpetersson in sbomify/sbomify-action#226
• Preserve PURLs without versions during enrichment by @​vpetersson in sbomify/sbomify-action#229
• Skip --required-only for Go in cdxgen (fixes #231) by @​vpetersson in sbomify/sbomify-action#234
• Handle DUPLICATE_NAME on component create (get-or-create) by @​vpetersson in sbomify/sbomify-action#236
• Add OIDC trusted-publishing support by @​vpetersson in sbomify/sbomify-action#235
• fix(deps): patch non-test Dependabot security alerts (idna, urllib3, pip) by @​vpetersson in sbomify/sbomify-action#241
• fix(wizard): component_type 422, existing sbomify.json, edge-case hardening + review fixes by @​aurangzaib048 in sbomify/sbomify-action#240
• chore(deps): bump docker/login-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in sbomify/sbomify-action#237
• feat(wizard): auto-register OIDC trusted publisher during apply by @​aurangzaib048 in sbomify/sbomify-action#242
• chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 by @​dependabot[bot] in sbomify/sbomify-action#244
• chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in sbomify/sbomify-action#243
• feat: Textual onboarding wizard + consolidated sbomify API client by @​vpetersson in sbomify/sbomify-action#238
• ci: add OpenGrep SAST workflow by @​vpetersson in sbomify/sbomify-action#246
• docs: lead README with the setup wizard by @​vpetersson in sbomify/sbomify-action#245
• fix: bundle wizard styles.tcss in published package by @​vpetersson in sbomify/sbomify-action#247
• ci: build and push multi-arch (amd64+arm64) Docker images by @​vpetersson in sbomify/sbomify-action#248
• fix: render wizard in truecolor inside Docker by @​vpetersson in sbomify/sbomify-action#249
• fix(wizard): derive repo name from git remote; ship git in runtime image by @​vpetersson in sbomify/sbomify-action#251
• feat: make the onboarding wizard fit any terminal (responsive TUI) by @​vpetersson in sbomify/sbomify-action#253
• Add missing deptrack upload options by @​Erik-Hoffmann in sbomify/sbomify-action#230
• fix: fail the run when a post-upload processor fails by @​aurangzaib048 in sbomify/sbomify-action#261
• feat: add BOM_TYPE to upload VEX/CBOM/HBOM artifacts verbatim by @​aurangzaib048 in sbomify/sbomify-action#255
• chore(deps): bump actions/cache from 5.0.5 to 6.1.0 by @​dependabot[bot] in sbomify/sbomify-action#263
• chore(deps): bump github/codeql-action/upload-sarif from 3.36.2 to 4.36.2 by @​dependabot[bot] in sbomify/sbomify-action#262
• chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 by @​dependabot[bot] in sbomify/sbomify-action#257
• chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in sbomify/sbomify-action#256
• chore(deps): bump github/codeql-action from 3.36.2 to 4.36.2 by @​dependabot[bot] in sbomify/sbomify-action#254
• feat(wizard): resolve sbomify-action pin at runtime with offline fallback by @​vpetersson in sbomify/sbomify-action#250
• chore(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in sbomify/sbomify-action#270
• chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in sbomify/sbomify-action#269
• chore(deps): bump actions/attest-build-provenance from 4.1.0 to 4.1.1 by @​dependabot[bot] in sbomify/sbomify-action#268
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by @​dependabot[bot] in sbomify/sbomify-action#267
• chore(deps): bump docker/login-action from 4.2.0 to 4.4.0 by @​dependabot[bot] in sbomify/sbomify-action#266
• fix(wizard): skip AI agent worktree dirs during lockfile discovery by @​vpetersson in sbomify/sbomify-action#271
• fix: make partial release failures fatal by @​vpetersson in sbomify/sbomify-action#272
• Bumps tools by @​vpetersson in sbomify/sbomify-action#274
• ci: build Docker images natively per-arch via matrix by @​vpetersson in sbomify/sbomify-action#275

... (truncated)

Commits

• ddf6a0d Merge pull request #283 from sbomify/fix/wizard-calver-tags
• 8769fd4 Merge pull request #282 from sbomify/fix/wizard-default-recommended-augmentation
• aa93a7c Address Copilot's round-1 review on the wizard
• ba7fd7c fix: wizard tag dispatch covers bare-numeric versions; sentinel carries real ...
• 4e4698b fix(wizard): default augmentation to the recommended contact-profile option
• 009b450 Merge pull request #265 from aurangzaib048/feat/multi-format-vex
• 48571a9 fix: read SBOM/VEX JSON as utf-8-sig so a UTF-8 BOM is accepted, not rejected
• 0a61193 docs: upload_sbom header describes both artifact endpoints (format-specific +...
• 1cbd155 fix: harden VEX upload path — UTF-8 validation, external-VEX routing guard, DRY
• 51670ce fix: restore sbomify-action.cdx.json (a hatchling build input, not a scratch ...
• Additional commits viewable in compare view

Updates actions/attest from 4.1.1 to 4.2.0

Release notes

Sourced from actions/attest's releases.

v4.2.0

What's Changed

• fix: split checksums on any line ending so LF files parse on Windows by @​bdehamer in actions/attest#443
• Bump @​actions/glob from 0.6.1 to 0.7.0 in the npm-production group across 1 directory by @​dependabot[bot] in actions/attest#435
• Bump csv-parse from 6.2.1 to 7.0.1 by @​dependabot[bot] in actions/attest#437
• Read subjects from GITHUB_ARTIFACTS_LIST by @​bdehamer in actions/attest#447
• Support SHA-2 subject digests by @​bdehamer in actions/attest#446

Full Changelog: actions/attest@v4.1.1...v4.2.0

Commits

• f7c74d2 feat: support SHA-2 subject digests (#446)
• 88633d1 Bump js-yaml from 4.2.0 to 5.2.1 (#452)
• 5dff824 Bump the actions-minor group with 3 updates (#453)
• e67e539 Bump the npm-development group across 1 directory with 2 updates (#448)
• 95f6155 Bump @​types/node from 25.9.2 to 26.1.1 (#449)
• b644c72 Read subjects from GITHUB_ARTIFACTS_LIST (#447)
• 7d3af28 Bump csv-parse from 6.2.1 to 7.0.1 (#437)
• 52cbb4d Bump @​actions/glob from 0.6.1 to 0.7.0 in the npm-production group across 1 d...
• a5ce33e ci: download rebuilt dist/ artifact outside the checkout workspace (#445)
• 4c65731 ci: auto-rebuild dist/ for Dependabot production bumps (#444)
• Additional commits viewable in compare view

Updates github/codeql-action/init from 4.37.0 to 4.37.1

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.1

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

... (truncated)

Commits

• 7188fc3 Merge pull request #4020 from github/update-v4.37.1-9e7c07009
• c8b5f69 Update changelog for v4.37.1
• 9e7c070 Merge pull request #4014 from github/mbg/explicit-remote-prefix
• 3492b7e Change REMOTE_PATH_PREFIX to remote=
• 3654baa Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix
• 2d682ac Merge pull request #4017 from github/dependabot/github_actions/dot-github/wor...
• 23f6a50 Merge pull request #4009 from github/mbg/action-state/additions
• 1ee3c75 Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...
• e053684 Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...
• 6803c56 Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.1
• Additional commits viewable in compare view

Updates github/codeql-action/autobuild from 4.37.0 to 4.37.1

Release notes

Sourced from github/codeql-action/autobuild's releases.

v4.37.1

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

Changelog

Sourced from github/codeql-action/autobuild's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

... (truncated)

Commits

• 7188fc3 Merge pull request #4020 from github/update-v4.37.1-9e7c07009
• c8b5f69 Update changelog for v4.37.1
• 9e7c070 Merge pull request #4014 from github/mbg/explicit-remote-prefix
• 3492b7e Change REMOTE_PATH_PREFIX to remote=
• 3654baa Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix
• 2d682ac Merge pull request #4017 from github/dependabot/github_actions/dot-github/wor...
• 23f6a50 Merge pull request #4009 from github/mbg/action-state/additions
• 1ee3c75 Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...
• e053684 Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...
• 6803c56 Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.1
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.0 to 4.37.1

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.1

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

... (truncated)

Commits

• 7188fc3 Merge pull request #4020 from github/update-v4.37.1-9e7c07009
• c8b5f69 Update changelog for v4.37.1
• 9e7c070 Merge pull request #4014 from github/mbg/explicit-remote-prefix
• 3492b7e Change REMOTE_PATH_PREFIX to remote=
• 3654baa Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix
• 2d682ac Merge pull request #4017 from github/dependabot/github_actions/dot-github/wor...
• 23f6a50 Merge pull request #4009 from github/mbg/action-state/additions
• 1ee3c75 Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...
• e053684 Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...
• 6803c56 Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.1
• Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.37.0 to 4.37.1

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.37.1

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

... (truncated)

Commits

• 7188fc3 Merge pull request #4020 from github/update-v4.37.1-9e7c07009
• c8b5f69 Update changelog for v4.37.1
• 9e7c070 Merge pull request #4014 from github/mbg/explicit-remote-prefix
• 3492b7e Change REMOTE_PATH_PREFIX to remote=
• 3654baa Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix
• 2d682ac Merge pull request #4017 from github/dependabot/github_actions/dot-github/wor...
• 23f6a50 Merge pull request #4009 from github/mbg/action-state/additions
• 1ee3c75 Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...
• e053684 Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...
• 6803c56 Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions