Skip to content

ci(deps): bump the github-actions group across 1 directory with 8 updates#753

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-1bd12086e1
Open

ci(deps): bump the github-actions group across 1 directory with 8 updates#753
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-1bd12086e1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 25, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 8 updates in the / directory:

Package From To
actions/checkout 6 7
actions/setup-python 6.2.0 6.3.0
actions/setup-java 5.2.0 5.3.0
actions/setup-go 6.4.0 6.5.0
actions/setup-dotnet 5.2.0 5.3.0
github/codeql-action 4.35.2 4.36.2
ruby/setup-ruby 1.306.0 1.314.0
MarcoIeni/release-plz-action 0.5.128 0.5.130

Updates actions/checkout from 6 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Full Changelog: actions/checkout@v6...v6.0.1

Commits

Updates actions/setup-python from 6.2.0 to 6.3.0

Release notes

Sourced from actions/setup-python's releases.

v6.3.0

What's Changed

Enhancement

Dependency update

Documentation

New Contributors

Full Changelog: actions/setup-python@v6...v6.3.0

Commits

Updates actions/setup-java from 5.2.0 to 5.3.0

Release notes

Sourced from actions/setup-java's releases.

v5.3.0

What's Changed

New Contributors

Full Changelog: actions/setup-java@v5...v5.3.0

Commits
  • ad2b381 Bump @​vercel/ncc from 0.38.1 to 0.44.0 (#1018)
  • b24df5b Make the Adoptopenjdk package type look at the Temurin repo first for latest ...
  • 43120bc Implement pagination with link headers for Adoptium based apis (#1014)
  • ad9d6a6 Bump @​types/node from 24.1.0 to 25.9.3 (#950)
  • 039af37 Bump picomatch, @​types/jest, jest, jest-circus and ts-jest (#1016)
  • 1756ab6 Bump eslint-config-prettier from 8.10.0 to 10.1.8 (#881)
  • 662bb59 Bump @​typescript-eslint/eslint-plugin from 8.35.1 to 8.46.2 (#952)
  • 1071fc1 fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parse...
  • 576b821 Merge pull request #674 from gdams/alpine
  • 307d3a2 update readme for ubuntu sudo java_home behavior (#1013)
  • Additional commits viewable in compare view

Updates actions/setup-go from 6.4.0 to 6.5.0

Release notes

Sourced from actions/setup-go's releases.

v6.5.0

What's Changed

Dependency update

New Contributors

Full Changelog: actions/setup-go@v6...v6.5.0

Commits

Updates actions/setup-dotnet from 5.2.0 to 5.3.0

Release notes

Sourced from actions/setup-dotnet's releases.

v5.3.0

What's Changed

Enhancements

Dependency Updates

Bug Fixes

New Contributors

Full Changelog: actions/setup-dotnet@v5...v5.3.0

Commits
  • 9a946fd Add rollForward note in README, improve proxy health check in e2e tests and b...
  • 98af08b Support global.json's rollForward latest* variants (#538)
  • 8404272 Update install scripts to v2026.05.19 (#736)
  • f1970f5 Don't download releases-index.json to resolve major version (#560)
  • af9211b Add dotnet-version: latest support with dotnet-channel input (#730)
  • df991ae chore: bump @actions/* and fast-xml-parser dependencies (#728)
  • a66eefa CI: remove manual PowerShell install from test-proxy job (e2e-tests.yml) (#703)
  • See full diff in compare view

Updates github/codeql-action from 4.35.2 to 4.36.2

Release notes

Sourced from github/codeql-action's releases.

v4.36.2

  • Cache CodeQL CLI version information across Actions steps. #3943
  • Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
  • Update default CodeQL bundle version to 2.25.6. #3948

v4.36.1

No user facing changes.

v4.36.0

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
  • Add support for SHA-256 Git object IDs. #3893
  • Update default CodeQL bundle version to 2.25.5. #3926

v4.35.5

  • We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
  • For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
  • If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
  • Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

v4.35.4

  • Update default CodeQL bundle version to 2.25.4. #3881

v4.35.3

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
  • Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
  • Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
  • Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
  • Update default CodeQL bundle version to 2.25.3. #3865
Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.36.2 - 04 Jun 2026

  • Cache CodeQL CLI version information across Actions steps. #3943
  • Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
  • Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
  • Add support for SHA-256 Git object IDs. #3893
  • Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

  • We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
  • For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
  • If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
  • Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

  • Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
  • Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
  • Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
  • Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
  • Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

  • The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795
  • The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789
  • Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794
  • Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807
  • Update default CodeQL bundle version to 2.25.2. #3823

... (truncated)

Commits
  • 8aad20d Merge pull request #3949 from github/update-v4.36.2-dcb947ce1
  • f521b08 Add additional changelog notes
  • 8aeff0f Update changelog for v4.36.2
  • dcb947c Merge pull request #3948 from github/update-bundle/codeql-bundle-v2.25.6
  • c251bce Add changelog note
  • 62953c1 Update default bundle to codeql-bundle-v2.25.6
  • 423b570 Merge pull request #3946 from github/dependabot/npm_and_yarn/npm-minor-5d507a...
  • c35d1b1 Merge pull request #3947 from github/dependabot/github_actions/dot-github/wor...
  • cb1a588 Merge pull request #3937 from github/robertbrignull/waitForProcessing_backoff
  • ba47406 Merge pull request #3943 from github/henrymercer/cache-cli-version-info
  • Additional commits viewable in compare view

Updates ruby/setup-ruby from 1.306.0 to 1.314.0

Release notes

Sourced from ruby/setup-ruby's releases.

v1.314.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.313.0...v1.314.0

v1.313.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.312.0...v1.313.0

v1.312.0

What's Changed

New Contributors

Full Changelog: ruby/setup-ruby@v1.311.0...v1.312.0

v1.311.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.310.0...v1.311.0

v1.310.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.309.0...v1.310.0

v1.309.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.308.0...v1.309.0

v1.308.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.307.0...v1.308.0

... (truncated)

Commits
  • 9eb537c Add support for ubuntu-26.04 and ubuntu-26.04-arm
  • e1a3b10 Improve versions-strings-for-builder.rb
  • 0df5288 Remove gem install sassc on Windows JRuby
  • 89f9052 Add jruby-10.0.6.0
  • 12fd324 Use BUNDLE_LOCKFILE when detecting the lockfile
  • a99ac84 Add jruby-9.4.15.0
  • afeafc3 Add ruby-4.0.5
  • 28c65f7 Update CRuby releases on Windows
  • 97ecb7b Update CRuby releases on Windows
  • 6aaa311 Add ruby-4.0.4
  • Additional commits viewable in compare view

Updates MarcoIeni/release-plz-action from 0.5.128 to 0.5.130

Release notes

Sourced from MarcoIeni/release-plz-action's releases.

v0.5.130

What's Changed

Full Changelog: release-plz/action@v0.5...v0.5.130

v0.5.129

What's Changed

... (truncated)

Commits
  • e879257 Update to 0.3.159 (#439)
  • 29ecf01 don't threat http 422 errors as special (#438)
  • c6756a4 chore(deps): update dependency cargo-bins/cargo-binstall to v1.20.0 (#437)
  • 0c186bf chore(deps): update dependency taiki-e/install-action to v2.81.8 (#436)
  • 8fe2bb5 chore(deps): lock file maintenance (#435)
  • 675b30f chore(deps): update dependency taiki-e/install-action to v2.81.7 (#433)
  • 7f61f63 chore(deps): update github actions to v6.0.3 (#385)
  • 7600366 chore(deps): update dependency taiki-e/install-action to v2.81.6 (#432)
  • f983e75 chore(deps): update dependency taiki-e/install-action to v2.81.5 (#431)
  • 02994ce chore(deps): update dependency taiki-e/install-action to v2.81.4 (#430)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • `@dependabot unignore <ig...

Description has been truncated

@dependabot
ci(deps): bump the github-actions group across 1 directory with 8 upd…
e03ce22 
…ates

Bumps the github-actions group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6` | `7` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.2.0` | `6.3.0` |
| [actions/setup-java](https://github.com/actions/setup-java) | `5.2.0` | `5.3.0` |
| [actions/setup-go](https://github.com/actions/setup-go) | `6.4.0` | `6.5.0` |
| [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `5.2.0` | `5.3.0` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.35.2` | `4.36.2` |
| [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `1.306.0` | `1.314.0` |
| [MarcoIeni/release-plz-action](https://github.com/marcoieni/release-plz-action) | `0.5.128` | `0.5.130` |



Updates `actions/checkout` from 6 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v6...v7)

Updates `actions/setup-python` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@a309ff8...ece7cb0)

Updates `actions/setup-java` from 5.2.0 to 5.3.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@be666c2...ad2b381)

Updates `actions/setup-go` from 6.4.0 to 6.5.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@4a36011...924ae3a)

Updates `actions/setup-dotnet` from 5.2.0 to 5.3.0
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](actions/setup-dotnet@c2fa09f...9a946fd)

Updates `github/codeql-action` from 4.35.2 to 4.36.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@95e58e9...8aad20d)

Updates `ruby/setup-ruby` from 1.306.0 to 1.314.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](ruby/setup-ruby@c4e5b13...9eb537c)

Updates `MarcoIeni/release-plz-action` from 0.5.128 to 0.5.130
- [Release notes](https://github.com/marcoieni/release-plz-action/releases)
- [Commits](release-plz/action@1528104...e879257)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/setup-java
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/setup-go
  dependency-version: 6.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/setup-dotnet
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action
  dependency-version: 4.36.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: ruby/setup-ruby
  dependency-version: 1.314.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: MarcoIeni/release-plz-action
  dependency-version: 0.5.130
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 25, 2026
@anakrish anakrish requested a review from Copilot June 25, 2026 19:23
Copilot AI reviewed Jun 25, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates pinned GitHub Actions references across the repository’s CI workflows, primarily bumping actions/checkout to v7 and refreshing several language/tool setup actions to their latest patch releases to keep CI infrastructure current and secure.

Changes:

  • Bump actions/checkout from v6 to v7 across workflows (mostly via pinned commit SHA).
  • Bump actions/setup-{python,java,go,dotnet} to newer patch releases via pinned SHAs.
  • Bump github/codeql-action and MarcoIeni/release-plz-action pinned SHAs to newer releases.

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 5 comments.

Show a summary per file
File Description
.github/workflows/tests-debug.yml Update actions/checkout to v7 pinned SHA for debug CI.
.github/workflows/test-wasm.yml Update actions/checkout to v7 pinned SHA for WASM tests.
.github/workflows/test-ruby.yml Update actions/checkout to v7 pinned SHA for Ruby binding tests.
.github/workflows/test-python.yml Update actions/checkout to v7 pinned SHA and actions/setup-python to v6.3.0 pinned SHA.
.github/workflows/test-no-std.yml Update actions/checkout to v7 pinned SHA for no-std verification.
.github/workflows/test-musl.yml Update actions/checkout to v7 pinned SHA for musl target tests.
.github/workflows/test-java.yml Update actions/checkout to v7 pinned SHA and actions/setup-java to v5.3.0 pinned SHA.
.github/workflows/test-go.yml Update actions/checkout to v7 pinned SHA and actions/setup-go to v6.5.0 pinned SHA.
.github/workflows/test-ffi.yml Update actions/checkout to v7 pinned SHA for FFI tests.
.github/workflows/test-csharp.yml Update actions/checkout to v7 pinned SHA and actions/setup-dotnet to v5.3.0 pinned SHA for C# tests.
.github/workflows/test-c-cpp.yml Update actions/checkout to v7 pinned SHA for C/C++ binding tests.
.github/workflows/rust-clippy.yml Update actions/checkout to v7 pinned SHA and bump CodeQL upload-sarif action pinned SHA.
.github/workflows/release-plz.yml Update actions/checkout to v7 pinned SHA and bump release-plz-action pinned SHA.
.github/workflows/publish-wasm.yml Update actions/checkout to v7 pinned SHA for WASM publishing pipeline.
.github/workflows/publish-python.yml Update actions/checkout to v7 pinned SHA and actions/setup-python to v6.3.0 pinned SHA for Python publishing.
.github/workflows/publish-java.yml Update actions/checkout to v7 pinned SHA, actions/setup-java to v5.3.0 pinned SHA, and actions/setup-python to v6.3.0 pinned SHA (zigbuild path).
.github/workflows/pr.yml Update actions/checkout to v7 pinned SHA for PR CI entrypoint.
.github/workflows/pr-extensions.yml Update actions/checkout to v7 pinned SHA for extensions PR CI.
.github/workflows/miri.yml Bump actions/checkout from @v6 to @v7 (tag-based reference).
.github/workflows/feature-matrix.yml Update actions/checkout to v7 pinned SHA for feature-matrix CI.
.github/workflows/dependency-audit.yml Bump actions/checkout from @v6 to @v7 (tag-based reference) for audit/deny jobs.
.github/workflows/dependabot-refresh-cargo-lockfiles.yml Update actions/checkout pinned SHA to v7 (comment/version annotation needs to match).
.github/workflows/codeql.yml Update actions/checkout to v7 pinned SHA; bump setup-*, ruby/setup-ruby, and github/codeql-action pinned SHAs.

Comment thread .github/workflows/dependabot-refresh-cargo-lockfiles.yml
# scripts) may run against this checkout. Do NOT add cargo build/check/
# test/run steps.
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4.2.2
Comment thread .github/workflows/rust-clippy.yml
- name: Upload analysis results to GitHub
if: ${{ hashFiles('rust-clippy-results.sarif') != '' }}
uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v3.29.11
uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3.29.11
Comment thread .github/workflows/miri.yml
steps:
- name: Checkout repository
uses: actions/checkout@v6
uses: actions/checkout@v7
Comment thread .github/workflows/dependency-audit.yml
steps:
- name: Checkout repository
uses: actions/checkout@v6
uses: actions/checkout@v7
Comment thread .github/workflows/dependency-audit.yml
steps:
- name: Checkout repository
uses: actions/checkout@v6
uses: actions/checkout@v7
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant