Codestin Search App

dependabot · 2026-01-12T22:57:49Z

Bumps the actions-version-updates group with 16 updates in the / directory:

Package	From	To
step-security/harden-runner	`2.12.0`	`2.14.0`
actions/checkout	`4.2.2`	`6.0.1`
shivammathur/setup-php	`2.33.0`	`2.36.0`
actions/dependency-review-action	`4.7.1`	`4.8.2`
docker/setup-buildx-action	`3.10.0`	`3.12.0`
docker/build-push-action	`6.17.0`	`6.18.0`
stefanzweifel/git-auto-commit-action	`5.2.0`	`7.1.0`
actions/download-artifact	`4.3.0`	`7.0.0`
JetBrains/qodana-action	`201551778d1453e36c5c0aa26f89a94775cb1acc`	`f5aa2889b113c16bd6aee47817b027537ee33ac7`
actions/setup-node	`4.4.0`	`6.1.0`
mridang/action-semantic-release	`1`	`2`
ossf/scorecard-action	`2.4.1`	`2.4.3`
github/codeql-action	`3.28.18`	`4.31.10`
mridang/action-test-reporter	`1`	`3`
actions/upload-artifact	`4.6.2`	`6.0.0`
dorny/test-reporter	`2.0.0`	`2.5.0`

Updates step-security/harden-runner from 2.12.0 to 2.14.0

Release notes

Sourced from step-security/harden-runner's releases.

v2.14.0

What's Changed

Selective installation: Harden-Runner now skips installation on GitHub-hosted runners when the repository has a custom property skip_harden_runner, allowing organizations to opt out specific repos.

Avoid double install: The action no longer installs Harden-Runner if it’s already present on a GitHub-hosted runner, which could happen when a composite action also installs it.

Full Changelog: step-security/harden-runner@v2.13.3...v2.14.0

v2.13.3

What's Changed

Fixed an issue where process events were not uploaded in certain edge cases.

Full Changelog: step-security/harden-runner@v2.13.2...v2.13.3

v2.13.2

What's Changed

Fixed an issue where there was a limit of 512 allowed endpoints when using block egress policy. This restriction has been removed, allowing for an unlimited number of endpoints to be configured.

Harden Runner now automatically detects if the agent is already pre-installed on a custom VM image used by a GitHub-hosted runner. When detected, the action will skip reinstallation and use the existing agent.

Full Changelog: step-security/harden-runner@v2.13.1...v2.13.2

v2.13.1

What's Changed

Graceful handling of HTTP errors: Improved error handling when fetching Harden Runner policies from the StepSecurity Policy Store API, ensuring more reliable execution even in case of temporary network/API issues.

Security updates for npm dependencies: Updated vulnerable npm package dependencies to the latest secure versions.

Faster enterprise agent downloads: The enterprise agent is now downloaded from GitHub Releases instead of packages.stepsecurity.io, improving download speed and reliability.

Full Changelog: step-security/harden-runner@v2.13.0...v2.13.1

v2.13.0

What's Changed

Improved job markdown summary

Https monitoring for all domains (included with the enterprise tier)

Full Changelog: step-security/harden-runner@v2...v2.13.0

v2.12.2

What's Changed

Added HTTPS Monitoring for additional destinations - *.githubusercontent.com Bug fixes:

Implicitly allow local multicast, local unicast and broadcast IP addresses in block mode

Increased policy map size for block mode

... (truncated)

Commits

20cf305 Merge pull request #622 from step-security/feature/custom-property-skip
c51e8ee feat: skip agent install and post step on subsequent runs for GitHub-hosted r...
e152b90 feat: skip harden-runner based on repository custom property
ee1faec feat: replace skip-harden-runner with skip-on-custom-property input
1dc7c17 feat: add skip-harden-runner input to conditionally skip execution
df199fb Merge pull request #620 from step-security/rc-29
03d096a update agent
4090107 fix: update agent
95d9a5d Merge pull request #606 from step-security/rc-28
87e429d Update limitations.md
Additional commits viewable in compare view

Updates actions/checkout from 4.2.2 to 6.0.1

Release notes

Sourced from actions/checkout's releases.

v6.0.1

What's Changed

Update all references from v5 and v4 to v6 by @ericsciple in actions/checkout#2314

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

Clarify v6 README by @ericsciple in actions/checkout#2328

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

Persist creds to a separate file by @ericsciple in actions/checkout#2286

v6-beta by @ericsciple in actions/checkout#2298

update readme/changelog for v6 by @ericsciple in actions/checkout#2311

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

What's Changed

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

Prepare v5.0.0 release by @salmanmkc in actions/checkout#2238

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.1

What's Changed

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

v4.2.0

Add Ref and Commit outputs by @lucacome in actions/checkout#1180

Dependency updates by @dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in actions/checkout#1739

Bump actions/checkout from 3 to 4 by @dependabot in actions/checkout#1697

Check out other refs/* by commit by @orhantoy in actions/checkout#1774

Pin actions/checkout's own workflows to a known, good, stable version. by @jww3 in actions/checkout#1776

v4.1.6

Check platform to set archive extension appropriately by @cory-miller in actions/checkout#1732

... (truncated)

Commits

8e8c483 Clarify v6 README (#2328)
033fa0d Add worktree support for persist-credentials includeIf (#2327)
c2d88d3 Update all references from v5 and v4 to v6 (#2314)
1af3b93 update readme/changelog for v6 (#2311)
71cf226 v6-beta (#2298)
069c695 Persist creds to a separate file (#2286)
ff7abcd Update README to include Node.js 24 support details and requirements (#2248)
08c6903 Prepare v5.0.0 release (#2238)
9f26565 Update actions checkout to use node 24 (#2226)
08eba0b Prepare release v4.3.0 (#2237)
Additional commits viewable in compare view

Updates shivammathur/setup-php from 2.33.0 to 2.36.0

Release notes

Sourced from shivammathur/setup-php's releases.

2.36.0

Changelog

Added support for PHP 8.5 stable release.
- name: Setup PHP 8.5 (stable)
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
Added support for PHP 8.6.0-dev. Specifying 8.6 in the php-version input should now set up a nightly build from the master branch of php-src. (#1002)
- name: Setup PHP 8.6.0-dev
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.6'
Added support for pdo_ibm and ibm_db2 extensions.
- name: Setup PHP with pdo_ibm and ibm_db2 extensions
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    extensions: pdo_ibm, ibm_db2
Added support to install blackfire extension on PHP 8.5.
- name: Setup PHP with blackfire extension
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    extensions: blackfire
Improved support to detect the required libraries when building from source for common extensions. For example installing gnupg from source would install the required libgpgme library automatically. (#1021)
- name: Setup PHP with amqp extension
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    extensions: gnupg-1.5.4

... (truncated)

Commits

44454db Fix check_lists in ppa.sh
9d7558f Revert to using php-builder for PHP 8.3 and above for self-hosted
7bf05c6 Update README
5daa53f Fix shellcheck in darwin.sh
e8f032a Fix linking
f96e84a Bump version to 2.36.0
4abbbd6 Fix build pdo_oci on macos for PHP 7.0
a19278e Update actions/checkout to v6
4364ed4 Merge pull request #1030 from shivammathur/dependabot/github_actions/develop/...
8dcd37f Improve macos php setup
Additional commits viewable in compare view

Updates actions/dependency-review-action from 4.7.1 to 4.8.2

Release notes

Sourced from actions/dependency-review-action's releases.

v4.8.2

Minor fixes:

Fix PURL parsing for scoped packages (#1008 from @danielhardej)

Fix for large summaries (#1007 from @gitulisca)

README includes a working example for allow-dependencies-licenses (#1009 from @danielhardej)

Dependency Review Action v4.8.1

What's Changed

(bug) Fix spamming link test in deprecation warning (again) by @ahpook in actions/dependency-review-action#1000

Bump version for 4.8.1 release by @ahpook in actions/dependency-review-action#1001

Full Changelog: actions/dependency-review-action@v4...v4.8.1

v4.8.0

What's Changed

Make Ruby Code Scannable by @ljones140 in actions/dependency-review-action#978

Batch some contributions for release by @brrygrdn in actions/dependency-review-action#986

Make license lists collapsable by @jasperkamerling

feat: add large summary handling with artifact upload by @MattMencel

New Contributors

@ljones140 made their first contribution in actions/dependency-review-action#978

@jasperkamerling made their first contribution in actions/dependency-review-action#986

@MattMencel made their first contribution in actions/dependency-review-action#986

Full Changelog: actions/dependency-review-action@v4...v4.8.0

4.7.3

What's Changed

Add explicit permissions to workflow files by @AshelyTC in actions/dependency-review-action#966

Claire153/fix spamming mentioned issue by @claire153 in actions/dependency-review-action#974

Full Changelog: actions/dependency-review-action@v4...v4.7.3

4.7.2

What's Changed

Add Missing Languages to CodeQL Advanced Configuration by @KyFaSt in actions/dependency-review-action#945

Deprecate deny lists by @claire153 in actions/dependency-review-action#958

Address discrepancy between docs and reality by @ahpook in actions/dependency-review-action#960

New Contributors

@KyFaSt made their first contribution in actions/dependency-review-action#945

@claire153 made their first contribution in actions/dependency-review-action#958

@ahpook made their first contribution in actions/dependency-review-action#960

Full Changelog: actions/dependency-review-action@v4...v4.7.2

Commits

3c4e3dc Merge pull request #1016 from actions/dra-release
02930b2 Update CONTRIBUTING to reflect new guidelines
49ffd9f Update CONTRIBUTING to reflect the need to build
70cb25e 4.8.2 release
ebabd31 Merge pull request #1008 from danielhardej/danielhardej-patch-20251023
19f9360 Update package-lock.json
5fd2f98 Bump @types/jest to version 29.5.14
28647f4 Fix PURL parsing by removing encodeURI
f620fd1 Merge pull request #1013 from actions/dangoor/token-fix
9b42b7e Remove bad token reference
Additional commits viewable in compare view

Updates docker/setup-buildx-action from 3.10.0 to 3.12.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v3.12.0

Deprecate install input by @crazy-max in docker/setup-buildx-action#455

Bump @docker/actions-toolkit from 0.62.1 to 0.63.0 in docker/setup-buildx-action#434

Bump brace-expansion from 1.1.11 to 1.1.12 in docker/setup-buildx-action#436

Bump form-data from 2.5.1 to 2.5.5 in docker/setup-buildx-action#432

Bump undici from 5.28.4 to 5.29.0 in docker/setup-buildx-action#435

Full Changelog: docker/setup-buildx-action@v3.11.1...v3.12.0

v3.11.1

Fix keep-state not being respected by @crazy-max in docker/setup-buildx-action#429

Full Changelog: docker/setup-buildx-action@v3.11.0...v3.11.1

v3.11.0

Keep BuildKit state support by @crazy-max in docker/setup-buildx-action#427

Remove aliases created when installing by default by @hashhar in docker/setup-buildx-action#139

Bump @docker/actions-toolkit from 0.56.0 to 0.62.1 in docker/setup-buildx-action#422 docker/setup-buildx-action#425

Full Changelog: docker/setup-buildx-action@v3.10.0...v3.11.0

Commits

8d2750c Merge pull request #455 from crazy-max/install-deprecated
e81846b deprecate install input
65d18f8 Merge pull request #454 from docker/dependabot/github_actions/actions/checkout-6
000d75d build(deps): bump actions/checkout from 5 to 6
1583c0f Merge pull request #443 from nicolasleger/patch-1
ed158e7 doc: bump actions/checkout from 4 to 5
4cc794f Merge pull request #441 from docker/dependabot/github_actions/actions/checkout-5
4dfc3d6 build(deps): bump actions/checkout from 4 to 5
af1b253 Merge pull request #440 from crazy-max/k3s-build
3c6ab92 ci: k3s test with latest buildx
Additional commits viewable in compare view

Updates docker/build-push-action from 6.17.0 to 6.18.0

Release notes

Sourced from docker/build-push-action's releases.

v6.18.0

Bump @docker/actions-toolkit from 0.61.0 to 0.62.1 in docker/build-push-action#1381

[!NOTE] Build summary is now supported with Docker Build Cloud.

Full Changelog: docker/build-push-action@v6.17.0...v6.18.0

Commits

2634353 Merge pull request #1381 from docker/dependabot/npm_and_yarn/docker/actions-t...
c0432d2 chore: update generated content
0bb1f27 set builder driver and endpoint attributes for dbc summary support
5f9dbf9 chore(deps): Bump @docker/actions-toolkit from 0.61.0 to 0.62.1
0788c44 Merge pull request #1375 from crazy-max/remove-gcr
aa179ca e2e: remove GCR
See full diff in compare view

Updates stefanzweifel/git-auto-commit-action from 5.2.0 to 7.1.0

Release notes

Sourced from stefanzweifel/git-auto-commit-action's releases.

v7.1.0

Added

Add skip_push input option (#401) @kvanzuijlen

Changes

docs: fix typo in README.md (#400) @GideonBear

Dependency Updates

Bump actions/checkout from 5 to 6 (#399) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

Bump bats from 1.12.0 to 1.13.0 (#398) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

v7.0.0

Added

Restore skip_fetch, skip_checkout, create_branch (#388) @stefanzweifel

Restore Detached State Detection (#393) @stefanzweifel

Add Support for Tag Messages (#391) @EliasBoulharts

Changed

Run Action on Node 24 (#389) @stefanzweifel

Dependency Updates

Bump actions/checkout from 4 to 5 (#386) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

v6.0.1

Fixed

Disable Check if Repo is in Detached State (#379) @stefanzweifel

v6.0.0

Added

Throw error early if repository is in a detached state (#357)

Fixed

Fix PAT instructions with Dependabot (#376) @Dreamsorcerer

Removed

Remove support for create_branch, skip_checkout, skip_Fetch (#314)

Changelog

Sourced from stefanzweifel/git-auto-commit-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Unreleased

TBD

v7.1.0 - 2025-12-17

Added

Add skip_push input option (#401) @kvanzuijlen

Changes

docs: fix typo in README.md (#400) @GideonBear

Dependency Updates

Bump actions/checkout from 5 to 6 (#399) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

Bump bats from 1.12.0 to 1.13.0 (#398) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

v7.0.0 - 2025-10-12

Added

Restore skip_fetch, skip_checkout, create_branch (#388) @stefanzweifel

Restore Detached State Detection (#393) @stefanzweifel

Add Support for Tag Messages (#391) @EliasBoulharts

Changed

Run Action on Node 24 (#389) @stefanzweifel

Dependency Updates

Bump actions/checkout from 4 to 5 (#386) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

v6.0.1 - 2025-06-11

Fixed

Disable Check if Repo is in Detached State (#379) @stefanzweifel

v6.0.0 - 2025-06-10

... (truncated)

Commits

04702ed Bump actions/checkout from 5 to 6 (#399)
1e49d50 Add skip_push input option (#401)
65c5677 docs: fix typo in README.md (#400)
547c140 Bump bats from 1.12.0 to 1.13.0 (#398)
8fa7f5a Update CHANGELOG
28e16e8 Release preparations for v7 (#394)
698fd76 Merge pull request #391 from EliasBoulharts/custom-tag-message
c40819a Update README
d7ee275 Change internal variable names
e8684eb Fix Tests
Additional commits viewable in compare view

Updates actions/download-artifact from 4.3.0 to 7.0.0

Release notes

Sourced from actions/download-artifact's releases.

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Update GHES guidance to include reference to Node 20 version by @patrikpolyak in actions/download-artifact#440

Download Artifact Node24 support by @salmanmkc in actions/download-artifact#415

fix: update @actions/artifact to fix Node.js 24 punycode deprecation by @salmanmkc in actions/download-artifact#451

prepare release v7.0.0 for Node.js 24 support by @salmanmkc in actions/download-artifact#452

New Contributors

@patrikpolyak made their first contribution in actions/download-artifact#440

@salmanmkc made their first contribution in actions/download-artifact#415

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

v6.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

Update README for download-artifact v5 changes by @yacaovsnc in actions/download-artifact#417

Update README with artifact extraction details by @yacaovsnc in actions/download-artifact#424

Readme: spell out the first use of GHES by @danwkennedy in actions/download-artifact#431

Bump @actions/artifact to v4.0.0

Prepare v6.0.0 by @danwkennedy in actions/download-artifact#438

New Contributors

@danwkennedy made their first contribution in actions/download-artifact#431

Full Changelog: actions/download-artifact@v5...v6.0.0

v5.0.0

What's Changed

Update README.md by @nebuk89 in actions/download-artifact#407

BREAKING fix: inconsistent path behavior for single artifact downloads by ID by @GrantBirki in actions/download-artifact#416

v5.0.0

🚨 Breaking Change

This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.

What Changed

... (truncated)

Commits

37930b1 Merge pull request #452 from actions/download-artifact-v7-release
72582b9 doc: update readme
0d2ec9d chore: release v7.0.0 for Node.js 24 support
fd7ae8f Merge pull request #451 from actions/fix-storage-blob
d484700 chore: restore minimatch.dep.yml license file
03a8080 chore: remove obsolete dependency license files
56fe6d9 chore: update @actions/artifact license file to 5.0.1
8e3ebc4 chore: update package-lock.json with @actions/artifact@5.0.1
1e3c4b4 fix: update @actions/artifact to ^5.0.0 for Node.js 24 punycode fix
458627d chore: use local @actions/artifact package for Node.js 24 testing
Additional commits viewable in compare view

Updates JetBrains/qodana-action from 201551778d1453e36c5c0aa26f89a94775cb1acc to f5aa2889b113c16bd6aee47817b027537ee33ac7

Commits

f5aa288 🐛 QD-11047 fix issue with quick-fixes: pull-request (#490)
26b380e 🐛 QD-11047 fix issue with quick-fixes in gitlab in branch mode (#482)
See full diff in compare view

Updates actions/setup-node from 4.4.0 to 6.1.0

Release notes

Sourced from actions/setup-node's releases.

v6.1.0

What's Changed

Enhancement:

Remove always-auth configuration handling by @priyagupta108 in actions/setup-node#1436

Dependency updates:

Upgrade @actions/cache from 4.0.3 to 4.1.0 by @dependabot[bot] in actions/setup-node#1384

Upgrade actions/checkout from 5 to 6 by @dependabot[bot] in actions/setup-node#1439

Upgrade js-yaml from 3.14.1 to 3.14.2 by @dependabot[bot] in actions/setup-node#1435

Documentation update:

Add example for restore-only cache in documentation by @aparnajyothi-y in actions/setup-node#1419

Full Changelog: actions/setup-node@v6...v6.1.0

v6.0.0

What's Changed

Breaking Changes

Limit automatic caching to npm, update workflows and documentation by @priyagupta108 in actions/setup-node#1374

Dependency Upgrades

Upgrade ts-jest from 29.1.2 to 29.4.1 and document breaking changes in v5 by @dependabot[bot] in #1336

Upgrade prettier from 2.8.8 to 3.6.2 by @dependabot[bot] in #1334

Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @dependabot[bot] in #1362

Full Changelog: actions/setup-node@v5...v6.0.0

v5.0.0

What's Changed

Breaking Changes

Enhance caching in setup-node with automatic package manager detection by @priya-kinthali in actions/setup-node#1348

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless. To disable this automatic caching, set package-manager-cache: false
steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false
Upgrade action to use node24 by @salmanmkc in actions/setup-node#1325

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

... (truncated)

Commits

395ad32 Bump js-yaml from 3.14.1 to 3.14.2 (#1435)
a4d2e2b Bump actions/checkout from 5 to 6 (#1439)
b9b25d4 Remove always-auth configuration handling from action (#1436)
633bb92 Bump @actions/cache from 4.0.3 to 4.1.0 (#1384)
dda4788 Add example for restore-only cache in documentation (#1419)
2028fbc Limit automatic caching to npm, update workflows and documentation (#1374)

…y with 16 updates Bumps the actions-version-updates group with 16 updates in the / directory: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.12.0` | `2.14.0` | | [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `6.0.1` | | [shivammathur/setup-php](https://github.com/shivammathur/setup-php) | `2.33.0` | `2.36.0` | | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.7.1` | `4.8.2` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.10.0` | `3.12.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6.17.0` | `6.18.0` | | [stefanzweifel/git-auto-commit-action](https://github.com/stefanzweifel/git-auto-commit-action) | `5.2.0` | `7.1.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `7.0.0` | | [JetBrains/qodana-action](https://github.com/jetbrains/qodana-action) | `201551778d1453e36c5c0aa26f89a94775cb1acc` | `f5aa2889b113c16bd6aee47817b027537ee33ac7` | | [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `6.1.0` | | [mridang/action-semantic-release](https://github.com/mridang/action-semantic-release) | `1` | `2` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.1` | `2.4.3` | | [github/codeql-action](https://github.com/github/codeql-action) | `3.28.18` | `4.31.10` | | [mridang/action-test-reporter](https://github.com/mridang/action-test-reporter) | `1` | `3` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `6.0.0` | | [dorny/test-reporter](https://github.com/dorny/test-reporter) | `2.0.0` | `2.5.0` | Updates `step-security/harden-runner` from 2.12.0 to 2.14.0 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@0634a26...20cf305) Updates `actions/checkout` from 4.2.2 to 6.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@11bd719...8e8c483) Updates `shivammathur/setup-php` from 2.33.0 to 2.36.0 - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@cf4cade...44454db) Updates `actions/dependency-review-action` from 4.7.1 to 4.8.2 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](actions/dependency-review-action@da24556...3c4e3dc) Updates `docker/setup-buildx-action` from 3.10.0 to 3.12.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@b5ca514...8d2750c) Updates `docker/build-push-action` from 6.17.0 to 6.18.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@1dc7386...2634353) Updates `stefanzweifel/git-auto-commit-action` from 5.2.0 to 7.1.0 - [Release notes](https://github.com/stefanzweifel/git-auto-commit-action/releases) - [Changelog](https://github.com/stefanzweifel/git-auto-commit-action/blob/master/CHANGELOG.md) - [Commits](stefanzweifel/git-auto-commit-action@b863ae1...04702ed) Updates `actions/download-artifact` from 4.3.0 to 7.0.0 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@d3f86a1...37930b1) Updates `JetBrains/qodana-action` from 201551778d1453e36c5c0aa26f89a94775cb1acc to f5aa2889b113c16bd6aee47817b027537ee33ac7 - [Release notes](https://github.com/jetbrains/qodana-action/releases) - [Commits](JetBrains/qodana-action@2015517...f5aa288) Updates `actions/setup-node` from 4.4.0 to 6.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@49933ea...395ad32) Updates `mridang/action-semantic-release` from 1 to 2 - [Release notes](https://github.com/mridang/action-semantic-release/releases) - [Changelog](https://github.com/mridang/action-semantic-release/blob/master/release.config.mjs) - [Commits](mridang/action-semantic-release@v1...v2) Updates `ossf/scorecard-action` from 2.4.1 to 2.4.3 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@f49aabe...4eaacf0) Updates `github/codeql-action` from 3.28.18 to 4.31.10 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@ff0a06e...cdefb33) Updates `mridang/action-test-reporter` from 1 to 3 - [Release notes](https://github.com/mridang/action-test-reporter/releases) - [Changelog](https://github.com/mridang/action-test-reporter/blob/master/release.config.mjs) - [Commits](mridang/action-test-reporter@v1...v3) Updates `actions/upload-artifact` from 4.6.2 to 6.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@ea165f8...b7c566a) Updates `dorny/test-reporter` from 2.0.0 to 2.5.0 - [Release notes](https://github.com/dorny/test-reporter/releases) - [Changelog](https://github.com/dorny/test-reporter/blob/main/CHANGELOG.md) - [Commits](dorny/test-reporter@6e6a65b...b082adf) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-version-updates - dependency-name: actions/checkout dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: shivammathur/setup-php dependency-version: 2.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-version-updates - dependency-name: actions/dependency-review-action dependency-version: 4.8.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-version-updates - dependency-name: docker/setup-buildx-action dependency-version: 3.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-version-updates - dependency-name: docker/build-push-action dependency-version: 6.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-version-updates - dependency-name: stefanzweifel/git-auto-commit-action dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: actions/download-artifact dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: JetBrains/qodana-action dependency-version: f5aa2889b113c16bd6aee47817b027537ee33ac7 dependency-type: direct:production dependency-group: actions-version-updates - dependency-name: actions/setup-node dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: mridang/action-semantic-release dependency-version: '2' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: ossf/scorecard-action dependency-version: 2.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-version-updates - dependency-name: github/codeql-action dependency-version: 4.31.10 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: mridang/action-test-reporter dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: actions/upload-artifact dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: dorny/test-reporter dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-version-updates ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jan 12, 2026

dependabot bot force-pushed the dependabot/github_actions/actions-version-updates-d22a410950 branch from 44dbc39 to a2e6cbf Compare February 3, 2026 00:50

dependabot bot force-pushed the dependabot/github_actions/actions-version-updates-d22a410950 branch from a2e6cbf to 04b46f4 Compare February 23, 2026 20:26

dependabot bot force-pushed the dependabot/github_actions/actions-version-updates-d22a410950 branch from 04b46f4 to d7e7ee2 Compare March 2, 2026 20:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the actions-version-updates group across 1 directory with 16 updates#62

chore(deps): bump the actions-version-updates group across 1 directory with 16 updates#62
dependabot[bot] wants to merge 1 commit intobetafrom
dependabot/github_actions/actions-version-updates-d22a410950

dependabot bot commented on behalf of github Jan 12, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.14.0

What's Changed

v2.13.3

What's Changed

v2.13.2

What's Changed

v2.13.1

What's Changed

v2.13.0

What's Changed

v2.12.2

What's Changed

v6.0.1

What's Changed

v6.0.0

What's Changed

v6-beta

What's Changed

v5.0.1

What's Changed

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v4.3.1

What's Changed

Changelog

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

2.36.0

Changelog

v4.8.2

Dependency Review Action v4.8.1

What's Changed

v4.8.0

What's Changed

New Contributors

4.7.3

What's Changed

4.7.2

What's Changed

New Contributors

v3.12.0

v3.11.1

v3.11.0

v6.18.0

v7.1.0

Added

Changes

Dependency Updates

v7.0.0

Added

Changed

Dependency Updates

v6.0.1

Fixed

v6.0.0

Added

Fixed

Removed

Changelog

Unreleased

v7.1.0 - 2025-12-17

Added

Changes

Dependency Updates

v7.0.0 - 2025-10-12

Added

dependabot bot commented on behalf of github Jan 12, 2026 •

edited

Loading