Skip to content
This repository was archived by the owner on Dec 10, 2025. It is now read-only.

build(deps): bump the dependencies group across 1 directory with 17 updates#366

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/dependencies-4e8baeef1f
Open

build(deps): bump the dependencies group across 1 directory with 17 updates#366
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/dependencies-4e8baeef1f

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 10, 2025 •
edited
Loading

Bumps the dependencies group with 17 updates in the / directory:

Package From To
actions/checkout 4.2.2 5.0.0
azure/setup-helm 4.3.0 4.3.1
actions/setup-python 5.6.0 6.0.0
helm/chart-testing-action 2.7.0 2.8.0
actions/setup-dotnet 4.3.1 5.0.0
github/codeql-action 3.28.16 4.31.2
actions/setup-java 4.7.1 5.0.0
actions/upload-artifact 4.6.2 5.0.0
checkmarx/kics-github-action 2.1.7 2.1.15
amannn/action-semantic-pull-request 5.5.3 6.1.1
marocchino/sticky-pull-request-comment 2.9.2 2.9.4
docker/login-action 3.4.0 3.6.0
docker/setup-buildx-action 3.10.0 3.11.1
docker/metadata-action 5.7.0 5.9.0
peter-evans/dockerhub-description 4.0.2 5.0.0
aquasecurity/trivy-action 0.30.0 0.33.1
trufflesecurity/trufflehog 3.88.25 3.90.13

Updates actions/checkout from 4.2.2 to 5.0.0

Release notes

Sourced from actions/checkout's releases.

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v4...v4.3.0

Changelog

Sourced from actions/checkout's changelog.

Changelog

V5.0.0

V4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v4.1.5

v4.1.4

v4.1.3

... (truncated)

Commits

Updates azure/setup-helm from 4.3.0 to 4.3.1

Release notes

Sourced from azure/setup-helm's releases.

v4.3.1

Changed

Added

Changelog

Sourced from azure/setup-helm's changelog.

Change Log

[4.3.1] - 2025-08-12

Changed

Added

[4.3.0] - 2025-02-15

  • #152 feat: log when restoring from cache
  • #157 Dependencies Update
  • #137 Add dependabot

[4.2.0] - 2024-04-15

  • #124 Fix OS detection and download OS-native archive extension

[4.1.0] - 2024-03-01

  • #130 switches to use Helm published file to read latest version instead of using GitHub releases

[4.0.0] - 2024-02-12

  • #121 update to node20 as node16 is deprecated
Commits
  • 1a275c3 build
  • 9e7f762 chore(release): v4.3.1 (#208)
  • c096176 Bump @​types/node from 24.1.0 to 24.2.1 in the actions group (#206)
  • 5e72872 ci(workflows): update helm version to v3.18.4 and add matrix for tests (#207)
  • fb8fa40 Update default helm version to 3.18.3 (#194)
  • 0d09729 chore: remove unnecessary prebuild script (#192)
  • 32bc120 chore(tests): Mock arch to make tests pass on arm host (#191)
  • 51463d6 Bump the actions group with 2 updates (#205)
  • aff1094 Bump the actions group across 1 directory with 2 updates (#204)
  • a10a524 Update helm version retrieval to use JSON output for latest version (#203)
  • Additional commits viewable in compare view

Updates actions/setup-python from 5.6.0 to 6.0.0

Release notes

Sourced from actions/setup-python's releases.

v6.0.0

What's Changed

Breaking Changes

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Enhancements:

Bug fixes:

Dependency updates:

New Contributors

Full Changelog: actions/setup-python@v5...v6.0.0

Commits
  • e797f83 Upgrade to node 24 (#1164)
  • 3d1e2d2 Revert "Enhance cache-dependency-path handling to support files outside the w...
  • 65b0712 Clarify pythonLocation behavior for PyPy and GraalPy in environment variables...
  • 5b668cf Bump actions/checkout from 4 to 5 (#1181)
  • f62a0e2 Change missing cache directory error to warning (#1182)
  • 9322b3c Upgrade setuptools to 78.1.1 to fix path traversal vulnerability in PackageIn...
  • fbeb884 Bump form-data to fix critical vulnerabilities #182 & #183 (#1163)
  • 03bb615 Bump idna from 2.9 to 3.7 in /tests/data (#843)
  • 36da51d Add version parsing from Pipfile (#1067)
  • 3c6f142 update documentation (#1156)
  • Additional commits viewable in compare view

Updates helm/chart-testing-action from 2.7.0 to 2.8.0

Release notes

Sourced from helm/chart-testing-action's releases.

v2.8.0

What's Changed

New Contributors

Full Changelog: helm/chart-testing-action@v2...v2.8.0

Commits
  • 6ec842c Bump sigstore/cosign-installer from 3.8.1 to 4.0.0 (#184)
  • 4ea74f6 Use uv instead of python venv (#172)
  • b0c0606 Bump the actions group across 1 directory with 2 updates (#183)
  • 0bfa5c0 Bump actions/setup-python from 5.4.0 to 6.0.0 (#179)
  • e27de75 Bump actions/checkout from 4.2.2 to 5.0.0 (#181)
  • 2fe8321 bump ct and yamale version (#178)
  • 0941a6b Fix the broken link for GitHub Help Documentation (#174)
  • c71c0c7 Bump the actions group across 1 directory with 4 updates (#171)
  • See full diff in compare view

Updates actions/setup-dotnet from 4.3.1 to 5.0.0

Release notes

Sourced from actions/setup-dotnet's releases.

v5.0.0

What's Changed

Breaking Changes

Make sure your runner is updated to this version or newer to use this release. v2.327.1 Release Notes

Dependency Updates

Bug Fixes

New Contributors

Full Changelog: actions/setup-dotnet@v4...v5.0.0

Commits

Updates github/codeql-action from 3.28.16 to 4.31.2

Release notes

Sourced from github/codeql-action's releases.

v4.31.2

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.2 - 30 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v4.31.1

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.1 - 30 Oct 2025

  • The add-snippets input has been removed from the analyze action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.

See the full CHANGELOG.md for more information.

v4.31.0

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.0 - 24 Oct 2025

  • Bump minimum CodeQL bundle version to 2.17.6. #3223
  • When SARIF files are uploaded by the analyze or upload-sarif actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the upload-sarif action. For analyze, this may affect Advanced Setup for CodeQL users who specify a value other than always for the upload input. #3222

See the full CHANGELOG.md for more information.

v4.30.9

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.9 - 17 Oct 2025

  • Update default CodeQL bundle version to 2.23.3. #3205
  • Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #3204

See the full CHANGELOG.md for more information.

v4.30.8

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

  • CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see Upcoming deprecation of CodeQL Action v3.

4.31.2 - 30 Oct 2025

No user facing changes.

4.31.1 - 30 Oct 2025

  • The add-snippets input has been removed from the analyze action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.

4.31.0 - 24 Oct 2025

  • Bump minimum CodeQL bundle version to 2.17.6. #3223
  • When SARIF files are uploaded by the analyze or upload-sarif actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the upload-sarif action. For analyze, this may affect Advanced Setup for CodeQL users who specify a value other than always for the upload input. #3222

4.30.9 - 17 Oct 2025

  • Update default CodeQL bundle version to 2.23.3. #3205
  • Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #3204

4.30.8 - 10 Oct 2025

No user facing changes.

4.30.7 - 06 Oct 2025

  • [v4+ only] The CodeQL Action now runs on Node.js v24. #3169

3.30.6 - 02 Oct 2025

  • Update default CodeQL bundle version to 2.23.2. #3168

3.30.5 - 26 Sep 2025

  • We fixed a bug that was introduced in 3.30.4 with upload-sarif which resulted in files without a .sarif extension not getting uploaded. #3160

3.30.4 - 25 Sep 2025

  • We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the codeql-action/init step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the codeql-action/init step. #3099 and #3100
  • We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. #3107
  • You can now run the latest CodeQL nightly bundle by passing tools: nightly to the init action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. #3130
  • Update default CodeQL bundle version to 2.23.1. #3118

3.30.3 - 10 Sep 2025

... (truncated)

Commits
  • 0499de3 Merge pull request #3261 from github/henrymercer/setup-python
  • 3b96745 Set up Python in mergeback workflow
  • 8a06050 Merge pull request #3259 from github/update-v4.31.2-9576b5cbe
  • 752a642 Update changelog for v4.31.2
  • 9576b5c Merge pull request #3258 from github/mbg/enablement-errors/case-insensitive
  • cc88437 Merge pull request #3257 from github/henrymercer/ubuntu-slim
  • f0e9bf0 Make isEnablementError case-insensitive
  • 2a3599c Run lightweight workflows on ubuntu-slim
  • 514ff4d Merge pull request #3256 from github/henrymercer/resolve-bad-merge
  • aab1c2f Merge pull request #3253 from github/mergeback/v4.31.1-to-main-5fe9434c
  • Additional commits viewable in compare view

Updates actions/setup-java from 4.7.1 to 5.0.0

Release notes

Sourced from actions/setup-java's releases.

v5.0.0

What's Changed

Breaking Changes

Make sure your runner is updated to this version or newer to use this release. v2.327.1 Release Notes

Dependency Upgrades

Bug Fixes

New Contributors

Full Changelog: actions/setup-java@v4...v5.0.0

Commits

Updates actions/upload-artifact from 4.6.2 to 5.0.0

Release notes

Sourced from actions/upload-artifact's releases.

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

New Contributors

Full Changelog: actions/upload-artifact@v4...v5.0.0

Commits
  • 330a01c Merge pull request #734 from actions/danwkennedy/prepare-5.0.0
  • 03f2824 Update github.dep.yml
  • 905a1ec Prepare v5.0.0
  • 2d9f9cd Merge pull request #725 from patrikpolyak/patch-1
  • 9687587 Merge branch 'main' into patch-1
  • 2848b2c Merge pull request #727 from danwkennedy/patch-1
  • 9b51177 Spell out the first use of GHES
  • cd231ca Update GHES guidance to include reference to Node 20 version
  • de65e23 Merge pull request #712 from actions/nebuk89-patch-1
  • 8747d8c Update README.md
  • Additional commits viewable in compare view

Updates checkmarx/kics-github-action from 2.1.7 to 2.1.15

Release notes

Sourced from checkmarx/kics-github-action's releases.

v2.1.15

What's Changed

Full Changelog: Checkmarx/kics-github-action@v2.1.14...v2.1.15

v2.1.14

What's Changed

Full Changelog: Checkmarx/kics-github-action@v2.1.13...v2.1.14

v2.1.13

What's Changed

Full Changelog: Checkmarx/kics-github-action@v2.1.12...v2.1.13

v2.1.12

What's Changed

Full Changelog: Checkmarx/kics-github-action@v2.1.11...v2.1.12

v2.1.11

What's Changed

Full Changelog: Checkmarx/kics-github-action@v2.1.10...v2.1.11

v2.1.10

What's Changed

@dependabot
build(deps): bump the dependencies group across 1 directory with 17 u…
5684c72 
…pdates

Bumps the dependencies group with 17 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `5.0.0` |
| [azure/setup-helm](https://github.com/azure/setup-helm) | `4.3.0` | `4.3.1` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5.6.0` | `6.0.0` |
| [helm/chart-testing-action](https://github.com/helm/chart-testing-action) | `2.7.0` | `2.8.0` |
| [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `4.3.1` | `5.0.0` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3.28.16` | `4.31.2` |
| [actions/setup-java](https://github.com/actions/setup-java) | `4.7.1` | `5.0.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `5.0.0` |
| [checkmarx/kics-github-action](https://github.com/checkmarx/kics-github-action) | `2.1.7` | `2.1.15` |
| [amannn/action-semantic-pull-request](https://github.com/amannn/action-semantic-pull-request) | `5.5.3` | `6.1.1` |
| [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment) | `2.9.2` | `2.9.4` |
| [docker/login-action](https://github.com/docker/login-action) | `3.4.0` | `3.6.0` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.10.0` | `3.11.1` |
| [docker/metadata-action](https://github.com/docker/metadata-action) | `5.7.0` | `5.9.0` |
| [peter-evans/dockerhub-description](https://github.com/peter-evans/dockerhub-description) | `4.0.2` | `5.0.0` |
| [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) | `0.30.0` | `0.33.1` |
| [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) | `3.88.25` | `3.90.13` |



Updates `actions/checkout` from 4.2.2 to 5.0.0
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11bd719...08c6903)

Updates `azure/setup-helm` from 4.3.0 to 4.3.1
- [Release notes](https://github.com/azure/setup-helm/releases)
- [Changelog](https://github.com/Azure/setup-helm/blob/main/CHANGELOG.md)
- [Commits](Azure/setup-helm@b9e5190...1a275c3)

Updates `actions/setup-python` from 5.6.0 to 6.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@a26af69...e797f83)

Updates `helm/chart-testing-action` from 2.7.0 to 2.8.0
- [Release notes](https://github.com/helm/chart-testing-action/releases)
- [Commits](helm/chart-testing-action@0d28d31...6ec842c)

Updates `actions/setup-dotnet` from 4.3.1 to 5.0.0
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](actions/setup-dotnet@67a3573...d4c9434)

Updates `github/codeql-action` from 3.28.16 to 4.31.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@28deaed...0499de3)

Updates `actions/setup-java` from 4.7.1 to 5.0.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@c5195ef...dded088)

Updates `actions/upload-artifact` from 4.6.2 to 5.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@ea165f8...330a01c)

Updates `checkmarx/kics-github-action` from 2.1.7 to 2.1.15
- [Release notes](https://github.com/checkmarx/kics-github-action/releases)
- [Commits](Checkmarx/kics-github-action@5373b38...86775e4)

Updates `amannn/action-semantic-pull-request` from 5.5.3 to 6.1.1
- [Release notes](https://github.com/amannn/action-semantic-pull-request/releases)
- [Changelog](https://github.com/amannn/action-semantic-pull-request/blob/main/CHANGELOG.md)
- [Commits](amannn/action-semantic-pull-request@0723387...48f2562)

Updates `marocchino/sticky-pull-request-comment` from 2.9.2 to 2.9.4
- [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases)
- [Commits](marocchino/sticky-pull-request-comment@67d0dec...7737449)

Updates `docker/login-action` from 3.4.0 to 3.6.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@74a5d14...5e57cd1)

Updates `docker/setup-buildx-action` from 3.10.0 to 3.11.1
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@b5ca514...e468171)

Updates `docker/metadata-action` from 5.7.0 to 5.9.0
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@902fa8e...318604b)

Updates `peter-evans/dockerhub-description` from 4.0.2 to 5.0.0
- [Release notes](https://github.com/peter-evans/dockerhub-description/releases)
- [Commits](peter-evans/dockerhub-description@432a30c...1b9a80c)

Updates `aquasecurity/trivy-action` from 0.30.0 to 0.33.1
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](aquasecurity/trivy-action@6c175e9...b6643a2)

Updates `trufflesecurity/trufflehog` from 3.88.25 to 3.90.13
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Changelog](https://github.com/trufflesecurity/trufflehog/blob/main/.goreleaser.yml)
- [Commits](trufflesecurity/trufflehog@d722a7e...f15cb8b)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: azure/setup-helm
  dependency-version: 4.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: actions/setup-python
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: helm/chart-testing-action
  dependency-version: 2.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: actions/setup-dotnet
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: github/codeql-action
  dependency-version: 4.31.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: actions/setup-java
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: actions/upload-artifact
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: checkmarx/kics-github-action
  dependency-version: 2.1.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: amannn/action-semantic-pull-request
  dependency-version: 6.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: marocchino/sticky-pull-request-comment
  dependency-version: 2.9.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: docker/login-action
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: docker/setup-buildx-action
  dependency-version: 3.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: docker/metadata-action
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: peter-evans/dockerhub-description
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: aquasecurity/trivy-action
  dependency-version: 0.33.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.90.13
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Nov 17, 2025

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

dependabot github-actions

Projects

Portal
Status: No status

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants