Bump the github-actions-version-updates group across 1 directory with 4 updates

[dependabot]

Bumps the github-actions-version-updates group with 4 updates in the /.github/workflows directory: oxsecurity/megalinter, github/codeql-action, docker/metadata-action and mikefarah/yq.

Updates oxsecurity/megalinter from 9.1.0 to 9.2.0

Release notes

Sourced from oxsecurity/megalinter's releases.

v9.2.0

What's Changed

• New linters

  • Salesforce Code Analyzer, by @​abdeslamads
    • SALESFORCE_CODE_ANALYZER_APEX
    • SALESFORCE_CODE_ANALYZER_AURA
    • SALESFORCE_CODE_ANALYZER_LWC

• Disabled linters

  • Reactivate checkov

• Deprecated linters

  • Deprecate terrascan as the project is discontinued. Will be completely removed in a future version.
  • SALESFORCE_SFDX_SCANNER_* linters have been deprecated and will be removed in a future version. (they are replaced by SALESFORCE_CODE_ANALYZER_* linters)

• Media

  • Looking for the best CI/CD Pipeline Linting Tool? Try MegaLinter!, by Seasoned Developer
  • (Brazilian) Qualidade e Segurança em Código com MegaLinter: automatizando análises em MAUI com GitHub Actions, by Canal dotNET

• Linters enhancements

  • Install dotenv-linter deterministically, by @​bdovaz in oxsecurity/megalinter#6385

• Fixes

  • #6544: Add GITHUB_TOKEN in docker build command for custom flavor
  • Hide warning when compiling a regex
  • Fix formatting in descriptor files to reduce changes in generated markdown, by @​echoix in oxsecurity/megalinter#6449

• Reporters

  • Add conversion from Jenkins variables to related Git based reporters variables

• Doc

  • Keep jsonschema html docs updated when using build.py --doc, by @​echoix in oxsecurity/megalinter#6447
  • Commit updated license info generated from build script by @​echoix in oxsecurity/megalinter#6448
  • Recreate docs/descriptors folder, delete old pages by @​echoix in oxsecurity/megalinter#6451

• Flavors

  • Add GITHUB_TOKEN in docker buildx build command for custom flavor, by @​davidfevre-gouv-nc in oxsecurity/megalinter#6545

• CI

  • Optimize performances of standalone linters releases
  • Renovate: Add langchain group for package updates, by @​echoix in oxsecurity/megalinter#6400
  • Refactor file handling in build.py to use pathlib for improved readability, by @​echoix in oxsecurity/megalinter#6450

• mega-linter-runner

  • Handle upgrade of stefanzweifel/git-auto-commit-action to v7

• Linter versions upgrades (53)

  • actionlint from 1.7.7 to 1.7.9
  • ansible-lint from 25.9.1 to 25.11.1

... (truncated)

Changelog

Sourced from oxsecurity/megalinter's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased] (beta, main branch content)

Note: Can be used with oxsecurity/megalinter@beta in your GitHub Action mega-linter.yml file, or with oxsecurity/megalinter:beta docker image

• Core

• New linters

  • Add codespell

• Disabled linters

• Deprecated linters

• Removed linters

• Media

• Linters enhancements

• Fixes

• Reporters

• Doc

• Flavors

• CI

  • Free disk space on GitHub actions runner when releasing a new flavor

• mega-linter-runner

• Linter versions upgrades (N)

[v9.2.0] - 2025-11-29

• New linters

  • Salesforce Code Analyzer, by @​abdeslamads
    • SALESFORCE_CODE_ANALYZER_APEX
    • SALESFORCE_CODE_ANALYZER_AURA
    • SALESFORCE_CODE_ANALYZER_LWC

• Disabled linters

... (truncated)

Commits

• 55a59b2 Release MegaLinter v9.2.0
• c94f8c8 prep release
• bca0a38 chore(deps): update dependency rubocop-rails to v2.34.2 (#6648)
• 8d505bf [automation] Auto-update linters version, help and documentation (#6659)
• a7d0161 Add conversion from Jenkins variables to related Git provider variables (#6658)
• 663b45a chore(deps): update mstruebing/editorconfig-checker docker tag to v3.6.0 (#6652)
• 64fbcca chore(deps): update docker/metadata-action action to v5.10.0 (#6651)
• b2f3c63 Hides regex compilation warning (#6657)
• 0eac80b chore(deps): update zricethezav/gitleaks docker tag to v8.30.0 (#6653)
• d1fdceb CI: Optimize standalone linters release perfs (#6656)
• Additional commits viewable in compare view

Updates github/codeql-action from 4.31.5 to 4.31.6

Release notes

Sourced from github/codeql-action's releases.

v4.31.6

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.6 - 01 Dec 2025

No user facing changes.

See the full CHANGELOG.md for more information.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.31.6 - 01 Dec 2025

No user facing changes.

4.31.5 - 24 Nov 2025

• Update default CodeQL bundle version to 2.23.6. #3321

4.31.4 - 18 Nov 2025

No user facing changes.

4.31.3 - 13 Nov 2025

• CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see Upcoming deprecation of CodeQL Action v3.
• Update default CodeQL bundle version to 2.23.5. #3288

4.31.2 - 30 Oct 2025

No user facing changes.

4.31.1 - 30 Oct 2025

• The add-snippets input has been removed from the analyze action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.

4.31.0 - 24 Oct 2025

• Bump minimum CodeQL bundle version to 2.17.6. #3223
• When SARIF files are uploaded by the analyze or upload-sarif actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the upload-sarif action. For analyze, this may affect Advanced Setup for CodeQL users who specify a value other than always for the upload input. #3222

4.30.9 - 17 Oct 2025

• Update default CodeQL bundle version to 2.23.3. #3205
• Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #3204

4.30.8 - 10 Oct 2025

No user facing changes.

4.30.7 - 06 Oct 2025

• [v4+ only] The CodeQL Action now runs on Node.js v24. #3169

... (truncated)

Commits

• fe4161a Merge pull request #3336 from github/update-v4.31.6-ecec1f887
• 88c2ab5 Update changelog for v4.31.6
• ecec1f8 Merge pull request #3335 from github/mbg/ci/run-codeql-on-all-prs
• 23da732 Merge pull request #3334 from github/kaspersv/overlay-minor-comments
• f7abc74 Remove branch filter for PR event in CodeQL workflow
• 32ada5e Merge branch 'main' into kaspersv/overlay-minor-comments
• 75b2f49 Merge pull request #3333 from github/kaspersv/overlay-no-resource-checks-option
• f036b1c Merge branch 'main' into kaspersv/overlay-no-resource-checks-option
• 58c5954 Add comment to runnerSupportsOverlayAnalysis
• b02fa13 Order feature flags alphabetically
• Additional commits viewable in compare view

Updates docker/metadata-action from 5.9.0 to 5.10.0

Release notes

Sourced from docker/metadata-action's releases.

v5.10.0

• Bump @​docker/actions-toolkit from 0.66.0 to 0.68.0 in docker/metadata-action#559 docker/metadata-action#569
• Bump js-yaml from 3.14.1 to 3.14.2 in docker/metadata-action#564

Full Changelog: docker/metadata-action@v5.9.0...v5.10.0

Commits

• c299e40 Merge pull request #569 from docker/dependabot/npm_and_yarn/docker/actions-to...
• f015d79 chore: update generated content
• 121bcc2 chore(deps): Bump @​docker/actions-toolkit from 0.67.0 to 0.68.0
• f7b6bf4 Merge pull request #564 from docker/dependabot/npm_and_yarn/js-yaml-3.14.2
• 0b95c6b Merge pull request #565 from docker/dependabot/github_actions/actions/checkout-6
• 17f70d7 Merge pull request #568 from motoki317/docs/fix-to-24h-schedule-pattern
• afd7e6d docs(README): Fix date format from 12h to 24h in schedule pattern
• 602aff8 chore(deps): Bump actions/checkout from 5 to 6
• aecb1a4 chore(deps): Bump js-yaml from 3.14.1 to 3.14.2
• 8d8c7c1 Merge pull request #559 from docker/dependabot/npm_and_yarn/docker/actions-to...
• Additional commits viewable in compare view

Updates mikefarah/yq from 4.49.1 to 4.49.2

Release notes

Sourced from mikefarah/yq's releases.

v4.49.2

• Fixing escape character bugs 😓 #2517
• Fixing snap release pipeline #2518 Thanks @​aalexjo

Changelog

Sourced from mikefarah/yq's changelog.

4.49.2:

• Fixing escape character bugs 😓 #2517
• Fixing snap release pipeline #2518 Thanks @​aalexjo

4.49.1:

• Added --security flags to disable env and file ops #2515
• Fixing TOML ArrayTable parsing issues #1758
• Fixing parsing of escaped characters #2506

4.48.2:

• Strip whitespace when decoding base64 #2507
• Upgraded to go-yaml v4! (thanks @​ccoVeille, @​ingydotnet)
• Add linux/loong64 to release target (thanks @​znley)
• Added --shell-key-separator flag for customizable shell output format #2497 (thanks @​rsleedbx)
• Bumped dependencies

4.48.1:

• Added 'parents' operator, to return a list of all the hierarchical parents of a node
• Added 'first(exp)' operator, to return the first entry matching an expression in an array
• Fixed xml namespace prefixes #1730 (thanks @​baodrate)
• Fixed out of range panic in yaml decoder #2460 (thanks @​n471d)
• Bumped dependencies

4.47.2:

• Conversion from TOML to JSON no longer omits empty tables #2459 (thanks @​louislouislouislouis)
• Bumped dependencies

4.47.1:

• Fixed merge anchor behaviour (<<); #2404, #2110, #2386, #2178 Huge thanks to @​stevenwdv! Note that you will need to set --yaml-fix-merge-anchor-to-spec to see the fixes
• Fixed panic for syntax error when creating a map #2423
• Bumped dependencies

4.46.1:

• Added INI support
• Fixed 'add' operator when piped in with no data #2378, #2383, #2384
• Fixed delete after slice problem (bad node path) #2387 Thanks @​antoinedeschenes
• Fixed yq small build Thanks @​imzue
• Switched to YAML org supported go-yaml!
• Bumped dependencies

4.45.4:

• Fixing wrong map() behaviour on empty map #2359
• Bumped dependencies

4.45.3:

• Fixing regression introduced with in 4.45.2 with #2325 fix 😓 sorry folks!
• Bumped dependencies

... (truncated)

Commits

• 7ccaf8e Bumping version
• a1a27b8 Updating release notes
• 1b91fc6 Removing escape char processing from strenv #2517
• 9e0c5fd Fixing escape charaters again 😢 #2517
• 5d0481c Running build step on launchpad remote builder with supported architectures
• f91176a Fixed architecture builders
• 8e86bdb Attempting to fix snap again
• fc164ca Updating README with latest yq help
• 810e9d9 Syncing how-it-works from gitbook branch
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[netlify]

✅ Deploy Preview for docs-securecodebox canceled.

Name	Link
🔨 Latest commit	53f1ca0
🔍 Latest deploy log	https://app.netlify.com/projects/docs-securecodebox/deploys/692d80d637270d0008b13805

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud