Sourced from step-security/harden-runner's releases.

v2.21.1

What's Changed

• Improved performance of the disable-sudo feature.
• Fixed an issue in the Community tier where new endpoints required by the GitHub Actions runner were not being implicitly allowed in block mode.
• Fixed the Harden-Runner post step failing on Linux distributions that do not have a merged /usr filesystem layout (for example Debian 11), where /usr/bin/echo does not exist. This mainly affected self-hosted runners.
• Documentation updates: clarified which features are in the Community (free) vs Enterprise tier.

Full Changelog: step-security/harden-runner@v2.21.0...v2.21.1

• e14015d Merge pull request #690 from step-security/rc-43
• 9001249 docs: update harden-runner version pin to v2.21.0 in getting started example
• a447fba docs: expand enterprise feature list and document custom VM and ubuntu-slim l...
• b0eaf8d docs: clarify community vs enterprise tiers and add maintained actions section
• 063e8e3 Merge pull request #687 from rohan-stepsecurity/rp/fix/bin-echo-fallback
• f46bdc1 chore: bump agent-ebpf to v1.9.1 and agent to v0.16.3
• 42e6daa fix: fall back to /bin/echo for non-usr-merged distros
• See full diff in compare view

Sourced from aws-actions/configure-aws-credentials's releases.

v6.2.4

6.2.4 (2026-08-31)

Bug Fixes

• account-ids handling, mask proxy as secret in logs (#1943) (aa65264)
• skip backoff sleep after the final retryAndBackoff attempt (#1937) (3852440)

Sourced from aws-actions/configure-aws-credentials's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

6.2.4 (2026-08-31)

Bug Fixes

• account-ids handling, mask proxy as secret in logs (#1943) (aa65264)
• skip backoff sleep after the final retryAndBackoff attempt (#1937) (3852440)

6.2.3 (2026-07-22)

Bug Fixes

• attach git credentials before Tag Major Version push (#1877) (9ae780b)
• PackedPolicyTooLarge detection in STS tags (#1899) (fa8d6a5)

6.2.2 (2026-07-07)

Miscellaneous Chores

• release 6.2.2 (d01d678)

6.2.1 (2026-06-26)

Bug Fixes

• enforce allowed-account-ids on all auth paths (#1847) (4d281fb)

6.2.0 (2026-06-01)

Features

• add additional session tags by default (#1775) (e0ba768)
• add more retry logic and better logging (#1764) (540d0c1)
• add regex validation to role-session-name (#1765) (e354499)
• Allow custom session tags to be passed when assuming a role (#1759) (61f50f6)
• expose run id in STS client user-agent (#1774) (29d1be3)
• support custom STS endpoints (#1762) (8d52d05)

Bug Fixes

• skip credential check on output-env-credentials: false (#1778) (58e7c47)
• assumeRole failing from session tag size too large (#1808) (d6f5dc3)

... (truncated)

• cbe3b39 chore(main): release 6.2.4 (#1942)
• 58065db chore(deps): bump js-yaml (#1944)
• 609df23 chore: Update dist
• aa65264 fix: account-ids handling, mask proxy as secret in logs (#1943)
• 7fdbbb8 chore: Update dist
• 3852440 fix: skip backoff sleep after the final retryAndBackoff attempt (#1937)
• c16f89b mention renamed repos use the new immutable identifiers (#1941)
• 9c362ee chore: Update dist
• d5f8da8 chore(deps): bump @​aws-sdk/client-sts from 3.1111.0 to 3.1116.0 (#1935)
• 2db2497 chore: Update dist
• Additional commits viewable in compare view

Sourced from fluxcd/flux2/action's releases.

v2.9.5

Highlights

Flux v2.9.5 is a patch release that moves helm-controller and source-controller back to upstream Helm, now at v4.2.4, dropping the temporary Flux fork. It hardens the handling of kubeconfig Secrets in helm-controller and kustomize-controller, which now reject kubeconfigs referencing files on the local filesystem and require credentials and certificates to be embedded inline. It also stops kustomize-controller from leaving behind the temporary directories of a previous process that exited without running its cleanup, and fixes a crash in post-build substitution where a substring expression with a negative length, e.g. ${VAR:2:-1}, panicked instead of counting back from the end of the string like Bash does. Across all controllers and the CLI, the fluxcd/pkg dependencies have been updated, bringing Kubernetes to 1.36.4. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Validate kubeconfigs from .spec.kubeConfig Secrets, rejecting local file references in certificate-authority, tokenFile, client-certificate and client-key; credentials and certificates must be embedded inline (helm-controller, kustomize-controller)
• Purge temporary directories at startup (kustomize-controller)
• Fix panic on negative-length substring expressions in post-build substitution (kustomize-controller, flux CLI)

Improvements:

• Move back to upstream Helm v4.2.4, dropping the Flux fork (helm-controller, source-controller)
• Update fluxcd/pkg dependencies, which bring Kubernetes to 1.36.4 (all controllers, flux CLI)

Components changelog

• source-controller v1.9.5
• source-watcher v2.2.4
• kustomize-controller v1.9.5
• helm-controller v1.6.4
• notification-controller v1.9.4
• image-reflector-controller v1.2.5
• image-automation-controller v1.2.5

CLI changelog

• Update fluxcd/pkg dependencies by @​fluxcdbot in fluxcd/flux2#6046
• Update fluxcd/pkg dependencies by @​fluxcdbot in fluxcd/flux2#6048
• Update toolkit components by @​fluxcdbot in fluxcd/flux2#6049

Full Changelog: fluxcd/flux2@v2.9.4...v2.9.5

• dd233c4 Merge pull request #6049 from fluxcd/update-components-release/v2.9.x
• 4d44125 Update toolkit components
• 17374db Merge pull request #6048 from fluxcd/update-pkg-deps/release/v2.9.x
• 370b47b Update fluxcd/pkg dependencies
• 58e047b Merge pull request #6046 from fluxcd/update-pkg-deps/release/v2.9.x
• f384418 Update fluxcd/pkg dependencies
• See full diff in compare view

• 1b1ed90 Merge pull request #41 from coder/fix/node20-runtime
• 06f0bf6 chore: rebuild dist with bun 1.3.14 to match CI
• 599f836 Revert "docs(readme): reference ecosystem precedent for node20"
• 425d2f5 docs(readme): reference ecosystem precedent for node20
• b38b9f0 docs(readme): explain the node20 runtime choice
• 603080b fix: target node20 so GHES 3.16 runners can load the action
• 39e7ac2 fix: anchor github-url host to GITHUB_SERVER_URL for GHES support
• e5ad4bb chore(readme): add GHES and $GITHUB_SERVER_URL
• 90dce8b fix: anchor github-url host to GITHUB_SERVER_URL for GHES support
• dc2f053 refactor(scripts/typegen): use guts/zod serializer via local package (#38)
• See full diff in compare view

Sourced from linear/linear-release-action's releases.

v0.17.2

What's Changed

• Release v0.17.2 by @​axelniklasson in linear/linear-release-action#67

Full Changelog: linear/linear-release-action@v0.17.1...v0.17.2

v0.17.1

What's Changed

• Document publish-time version assignment by @​RomainCscn in linear/linear-release-action#64
• Release v0.17.1 by @​RomainCscn in linear/linear-release-action#66

Full Changelog: linear/linear-release-action@v0.17.0...v0.17.1

v0.17.0

What's Changed

• Release v0.17.0 by @​RomainCscn in linear/linear-release-action#63

Full Changelog: linear/linear-release-action@v0.16.1...v0.17.0

v0.16.1

What's Changed

• Verify downloaded CLI artifacts before execution by @​RomainCscn in linear/linear-release-action#60
• Authenticate the CI install test's GitHub API calls by @​RomainCscn in linear/linear-release-action#62
• Release v0.16.1 by @​RomainCscn in linear/linear-release-action#61

Full Changelog: linear/linear-release-action@v0.16.0...v0.16.1

Note: cli_version: latest now resolves the release through the GitHub API, which requires jq and a token. Both are present on GitHub-hosted runners; minimal self-hosted runners without jq will fail with a clear error.

• 53ad0f8 Release v0.17.2 (#67)
• 3f31fcf Release v0.17.1 (#66)
• cbf1f6d Document publish-time version assignment (#64)
• e1ca7ca Release v0.17.0 (#63)
• 7d7409a Release v0.16.1 (#61)
• 9589057 Authenticate the CI install test's GitHub API calls (#62)
• fc505cb Verify future CLI release artifacts before execution (#60)
• See full diff in compare view

Sourced from github/codeql-action/upload-sarif's releases.

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

... (truncated)

• cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
• 7243f38 Update changelog for v4.37.9
• 920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
• ecfa6e1 Add changelog note
• adcdf4a Update default bundle to codeql-bundle-v2.26.4
• 486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
• 134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
• ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
• 4605e03 Rebuild
• 099c869 Update changelog and version after v4.37.8
• Additional commits viewable in compare view

Sourced from github/codeql-action/init's releases.

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

... (truncated)

• cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
• 7243f38 Update changelog for v4.37.9
• 920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
• ecfa6e1 Add changelog note
• adcdf4a Update default bundle to codeql-bundle-v2.26.4
• 486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
• 134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
• ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
• 4605e03 Rebuild
• 099c869 Update changelog and version after v4.37.8
• Additional commits viewable in compare view

Sourced from github/codeql-action/analyze's releases.

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

... (truncated)

• cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
• 7243f38 Update changelog for v4.37.9
• 920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
• ecfa6e1 Add changelog note
• adcdf4a Update default bundle to codeql-bundle-v2.26.4
• 486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
• 134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
• ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
• 4605e03 Rebuild
• 099c869 Update changelog and version after v4.37.8
• Additional commits viewable in compare view