Bump the actions-dependencies group with 6 updates #75

dependabot · 2025-10-10T08:02:40Z

Bumps the actions-dependencies group with 6 updates:

Package	From	To
step-security/harden-runner	`2.13.0`	`2.13.1`
actions/setup-go	`5.5.0`	`6.0.0`
github/codeql-action	`3.30.5`	`4.30.7`
actions/dependency-review-action	`4.7.1`	`4.8.0`
goreleaser/goreleaser-action	`6.3.0`	`6.4.0`
ossf/scorecard-action	`2.4.2`	`2.4.3`

Updates step-security/harden-runner from 2.13.0 to 2.13.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.13.1

What's Changed

Graceful handling of HTTP errors: Improved error handling when fetching Harden Runner policies from the StepSecurity Policy Store API, ensuring more reliable execution even in case of temporary network/API issues.

Security updates for npm dependencies: Updated vulnerable npm package dependencies to the latest secure versions.

Faster enterprise agent downloads: The enterprise agent is now downloaded from GitHub Releases instead of packages.stepsecurity.io, improving download speed and reliability.

Full Changelog: step-security/harden-runner@v2.13.0...v2.13.1

Commits

f4a75cf Merge pull request #588 from step-security/rc-26
95503d0 ci: remove code-review workflow
4b250a0 ci: add job to confirm dist is as expected
5b0ab6a update dependencies
d11f2c1 fix bug where status code was not being preserved
b3fc98e improve error handling for policy store sceanrio
92fc5d4 update error message
b61b0a4 policy store improvements
e3d3f2b use GitHub release instead of packages
646ac01 update agent
Additional commits viewable in compare view

Updates actions/setup-go from 5.5.0 to 6.0.0

Release notes

Sourced from actions/setup-go's releases.

v6.0.0

What's Changed

Breaking Changes

Improve toolchain handling to ensure more reliable and consistent toolchain selection and management by @matthewhughes934 in actions/setup-go#460

Upgrade Nodejs runtime from node20 to node 24 by @salmanmkc in actions/setup-go#624

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

Upgrade @types/jest from 29.5.12 to 29.5.14 by @dependabot[bot] in actions/setup-go#589

Upgrade @actions/tool-cache from 2.0.1 to 2.0.2 by @dependabot[bot] in actions/setup-go#591

Upgrade @typescript-eslint/parser from 8.31.1 to 8.35.1 by @dependabot[bot] in actions/setup-go#590

Upgrade undici from 5.28.5 to 5.29.0 by @dependabot[bot] in actions/setup-go#594

Upgrade typescript from 5.4.2 to 5.8.3 by @dependabot[bot] in actions/setup-go#538

Upgrade eslint-plugin-jest from 28.11.0 to 29.0.1 by @dependabot[bot] in actions/setup-go#603

Upgrade form-data to bring in fix for critical vulnerability by @matthewhughes934 in actions/setup-go#618

Upgrade actions/checkout from 4 to 5 by @dependabot[bot] in actions/setup-go#631

New Contributors

@matthewhughes934 made their first contribution in actions/setup-go#618

@salmanmkc made their first contribution in actions/setup-go#624

Full Changelog: actions/setup-go@v5...v6.0.0

Commits

4469467 Bump actions/checkout from 4 to 5 (#631)
e093d1e Node 24 upgrade (#624)
1d76b95 Improve toolchain handling (#460)
e75c3e8 Bump form-data to bring in fix for critical vulnerability (#618)
8e57b58 Bump eslint-plugin-jest from 28.11.0 to 29.0.1 (#603)
7c0b336 Bump typescript from 5.4.2 to 5.8.3 (#538)
6f26dcc Bump undici from 5.28.5 to 5.29.0 (#594)
8d4083a Bump @typescript-eslint/parser from 5.62.0 to 8.32.0 (#590)
fa96338 Bump @actions/tool-cache from 2.0.1 to 2.0.2 (#591)
4de67c0 Bump @types/jest from 29.5.12 to 29.5.14 (#589)
See full diff in compare view

Updates github/codeql-action from 3.30.5 to 4.30.7

Release notes

Sourced from github/codeql-action's releases.

v4.30.7

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.7 - 06 Oct 2025

[v4+ only] The CodeQL Action now runs on Node.js v24. #3169

See the full CHANGELOG.md for more information.

v3.30.7

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.7 - 06 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.30.6

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.6 - 02 Oct 2025

Update default CodeQL bundle version to 2.23.2. #3168

See the full CHANGELOG.md for more information.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.30.7 - 06 Oct 2025

[v4+ only] The CodeQL Action now runs on Node.js v24. #3169

3.30.6 - 02 Oct 2025

Update default CodeQL bundle version to 2.23.2. #3168

3.30.5 - 26 Sep 2025

We fixed a bug that was introduced in 3.30.4 with upload-sarif which resulted in files without a .sarif extension not getting uploaded. #3160

3.30.4 - 25 Sep 2025

We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the codeql-action/init step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the codeql-action/init step. #3099 and #3100

We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. #3107

You can now run the latest CodeQL nightly bundle by passing tools: nightly to the init action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. #3130

Update default CodeQL bundle version to 2.23.1. #3118

3.30.3 - 10 Sep 2025

No user facing changes.

3.30.2 - 09 Sep 2025

Fixed a bug which could cause language autodetection to fail. #3084

Experimental: The quality-queries input that was added in 3.29.2 as part of an internal experiment is now deprecated and will be removed in an upcoming version of the CodeQL Action. It has been superseded by a new analysis-kinds input, which is part of the same internal experiment. Do not use this in production as it is subject to change at any time. #3064

3.30.1 - 05 Sep 2025

Update default CodeQL bundle version to 2.23.0. #3077

3.30.0 - 01 Sep 2025

Reduce the size of the CodeQL Action, speeding up workflows by approximately 4 seconds. #3054

3.29.11 - 21 Aug 2025

Update default CodeQL bundle version to 2.22.4. #3044

3.29.10 - 18 Aug 2025

... (truncated)

Commits

e296a93 Merge pull request #3183 from github/update-v4.30.7-55283843c
93c1673 Update changelog for v4.30.7
5528384 Merge pull request #3169 from github/mario-campos/node24
b66db86 Hoist CHANGELOG note back to "UNRELEASED" section.
b2e2232 Merge remote-tracking branch 'origin/main' into mario-campos/node24
065c6cf Merge pull request #3174 from github/mbg/fix/start-proxy-matrix
7fb8378 Re-throw exception in createStatusReportBase when in test mode
dddf033 Revert changes to build.mjs
54ae8ba Simplify PR check by reverting changes to @types/node.
65e9e64 Make matrix available to start-proxy action
Additional commits viewable in compare view

Updates actions/dependency-review-action from 4.7.1 to 4.8.0

Release notes

Sourced from actions/dependency-review-action's releases.

v4.8.0

What's Changed

Make Ruby Code Scannable by @ljones140 in actions/dependency-review-action#978

Batch some contributions for release by @brrygrdn in actions/dependency-review-action#986

Make license lists collapsable by @jasperkamerling

feat: add large summary handling with artifact upload by @MattMencel

New Contributors

@ljones140 made their first contribution in actions/dependency-review-action#978

@jasperkamerling made their first contribution in actions/dependency-review-action#986

@MattMencel made their first contribution in actions/dependency-review-action#986

Full Changelog: actions/dependency-review-action@v4...v4.8.0

4.7.3

What's Changed

Add explicit permissions to workflow files by @AshelyTC in actions/dependency-review-action#966

Claire153/fix spamming mentioned issue by @claire153 in actions/dependency-review-action#974

Full Changelog: actions/dependency-review-action@v4...v4.7.3

4.7.2

What's Changed

Add Missing Languages to CodeQL Advanced Configuration by @KyFaSt in actions/dependency-review-action#945

Deprecate deny lists by @claire153 in actions/dependency-review-action#958

Address discrepancy between docs and reality by @ahpook in actions/dependency-review-action#960

New Contributors

@KyFaSt made their first contribution in actions/dependency-review-action#945

@claire153 made their first contribution in actions/dependency-review-action#958

@ahpook made their first contribution in actions/dependency-review-action#960

Full Changelog: actions/dependency-review-action@v4...v4.7.2

Commits

56339e5 Merge pull request #988 from actions/brrygrdn/rc-4.8.0
1688b74 Bump to a 4.8.0
31c9f17 Merge pull request #987 from actions/rc-4.7.4
eacde78 Update version
8151009 Merge pull request #986 from actions/brrygrdn/rc-4.7.4
b472ec9 Add a quick regression test for the artefact summary
e0cedc5 feat: add large summary handling with artifact upload
e3fdf0f This ensures large allow or deny lists don't create huge comments
6fad417 Merge pull request #978 from actions/ljones140/make-ruby-code-scannable
e86e969 Update scripts/scan_pr_lib.rb
Additional commits viewable in compare view

Updates goreleaser/goreleaser-action from 6.3.0 to 6.4.0

Release notes

Sourced from goreleaser/goreleaser-action's releases.

v6.4.0

What's Changed

ci: set contents read as default workflow permissions by @crazy-max in goreleaser/goreleaser-action#494

fix: support .config directory for goreleaser config files by @haya14busa in goreleaser/goreleaser-action#500

chore(deps): bump semver from 7.7.1 to 7.7.2 by @dependabot[bot] in goreleaser/goreleaser-action#495

chore(deps): bump brace-expansion from 1.1.11 to 1.1.12 by @dependabot[bot] in goreleaser/goreleaser-action#498

fix: do not get releases.json if version is specific by @caarlos0 in goreleaser/goreleaser-action#502

chore(deps): bump undici from 5.28.5 to 5.29.0 by @dependabot[bot] in goreleaser/goreleaser-action#496

feat: retry downloading releases json by @caarlos0 in goreleaser/goreleaser-action#503

New Contributors

@haya14busa made their first contribution in goreleaser/goreleaser-action#500

Full Changelog: goreleaser/goreleaser-action@v6.3.0...v6.4.0

Commits

e435ccd feat: retry downloading releases json (#503)
2ff5850 chore(deps): bump undici from 5.28.5 to 5.29.0 (#496)
9a6cd01 fix: do not get releases.json if version is specific (#502)
a386515 chore(deps): bump brace-expansion from 1.1.11 to 1.1.12 (#498)
ca48102 chore(deps): bump semver from 7.7.1 to 7.7.2 (#495)
0931acf fix: support .config directory for goreleaser config files (#500)
90c43f2 ci: set contents read as default workflow permissions (#494)
See full diff in compare view

Updates ossf/scorecard-action from 2.4.2 to 2.4.3

Release notes

Sourced from ossf/scorecard-action's releases.

v2.4.3

What's Changed

This update bumps the Scorecard version to the v5.3.0 release. For a complete list of changes, please refer to the Scorecard v5.3.0 release notes.

Documentation

docs: clarify GITHUB_TOKEN permissions needed for private repos by @pankajtaneja5 in ossf/scorecard-action#1574

📖 Fix recommended command to test the image in development by @deivid-rodriguez in ossf/scorecard-action#1583

Other

add missing top-level token permissions to workflows by @timothyklee in ossf/scorecard-action#1566

setup codeowners for requesting reviews by @spencerschrock in ossf/scorecard-action#1576

🌱 Improve printing options by @deivid-rodriguez in ossf/scorecard-action#1584

New Contributors

@timothyklee made their first contribution in ossf/scorecard-action#1566

@pankajtaneja5 made their first contribution in ossf/scorecard-action#1574

@deivid-rodriguez made their first contribution in ossf/scorecard-action#1584

Full Changelog: ossf/scorecard-action@v2.4.2...v2.4.3

Commits

4eaacf0 bump docker to ghcr v2.4.3 (#1587)
42e3a01 🌱 Bump the github-actions group with 3 updates (#1585)
88c07ac 🌱 Bump github.com/sigstore/cosign/v2 from 2.5.2 to 2.6.0 (#1579)
6c690f2 Bump github.com/ossf/scorecard/v5 from v5.2.1 to v5.3.0 (#1586)
92083b5 📖 Fix recommended command to test the image in development (#1583)
7975ea6 🌱 Bump the docker-images group across 1 directory with 2 updates (#1...
0d1a743 🌱 Bump github.com/spf13/cobra from 1.9.1 to 1.10.1 (#1575)
46e6e0c 🌱 Bump the github-actions group with 2 updates (#1580)
c3f1350 🌱 Improve printing options (#1584)
43e475b 🌱 Bump golang.org/x/net from 0.42.0 to 0.44.0 (#1578)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions-dependencies group with 6 updates: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.13.0` | `2.13.1` | | [actions/setup-go](https://github.com/actions/setup-go) | `5.5.0` | `6.0.0` | | [github/codeql-action](https://github.com/github/codeql-action) | `3.30.5` | `4.30.7` | | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.7.1` | `4.8.0` | | [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `6.3.0` | `6.4.0` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.2` | `2.4.3` | Updates `step-security/harden-runner` from 2.13.0 to 2.13.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@ec9f2d5...f4a75cf) Updates `actions/setup-go` from 5.5.0 to 6.0.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@d35c59a...4469467) Updates `github/codeql-action` from 3.30.5 to 4.30.7 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@3599b3b...e296a93) Updates `actions/dependency-review-action` from 4.7.1 to 4.8.0 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](actions/dependency-review-action@da24556...56339e5) Updates `goreleaser/goreleaser-action` from 6.3.0 to 6.4.0 - [Release notes](https://github.com/goreleaser/goreleaser-action/releases) - [Commits](goreleaser/goreleaser-action@9c156ee...e435ccd) Updates `ossf/scorecard-action` from 2.4.2 to 2.4.3 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@05b42c6...4eaacf0) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.13.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-dependencies - dependency-name: actions/setup-go dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-dependencies - dependency-name: github/codeql-action dependency-version: 4.30.7 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-dependencies - dependency-name: actions/dependency-review-action dependency-version: 4.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-dependencies - dependency-name: goreleaser/goreleaser-action dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-dependencies - dependency-name: ossf/scorecard-action dependency-version: 2.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 10, 2025

This was referenced Oct 10, 2025

Bump step-security/harden-runner from 2.13.0 to 2.13.1 #64

Closed

Bump actions/setup-go from 5.5.0 to 6.0.0 #66

Closed

Bump ossf/scorecard-action from 2.4.2 to 2.4.3 #69

Closed

chocolatkey merged commit 8e13b11 into develop Oct 10, 2025
3 checks passed

chocolatkey deleted the dependabot/github_actions/actions-dependencies-a32f3efc8c branch October 10, 2025 08:04

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the actions-dependencies group with 6 updates #75

Bump the actions-dependencies group with 6 updates #75

Uh oh!

dependabot bot commented on behalf of github Oct 10, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Bump the actions-dependencies group with 6 updates #75

Bump the actions-dependencies group with 6 updates #75

Uh oh!

Conversation

dependabot bot commented on behalf of github Oct 10, 2025

v2.13.1

What's Changed

v6.0.0

What's Changed

Breaking Changes

Dependency Upgrades

New Contributors

v4.30.7

CodeQL Action Changelog

4.30.7 - 06 Oct 2025

v3.30.7

CodeQL Action Changelog

3.30.7 - 06 Oct 2025

v3.30.6

CodeQL Action Changelog

3.30.6 - 02 Oct 2025

CodeQL Action Changelog

[UNRELEASED]

4.30.7 - 06 Oct 2025

3.30.6 - 02 Oct 2025

3.30.5 - 26 Sep 2025

3.30.4 - 25 Sep 2025

3.30.3 - 10 Sep 2025

3.30.2 - 09 Sep 2025

3.30.1 - 05 Sep 2025

3.30.0 - 01 Sep 2025

3.29.11 - 21 Aug 2025

3.29.10 - 18 Aug 2025

v4.8.0

What's Changed

New Contributors

4.7.3

What's Changed

4.7.2

What's Changed

New Contributors

v6.4.0

What's Changed

New Contributors

v2.4.3

What's Changed

Documentation

Other

New Contributors

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants