deps(actions): bump the actions group across 1 directory with 10 updates

[dependabot]

Bumps the actions group with 10 updates in the / directory:

Package	From	To
actions/ai-inference	2.0.7	2.1.0
github/codeql-action	4.35.2	4.35.5
dependabot/fetch-metadata	3.0.0	3.1.0
actions/labeler	6.0.1	6.1.0
ruby/setup-ruby	1.302.0	1.307.0
rubygems/configure-rubygems-credentials	1.0.0	2.0.0
actions/setup-node	6.3.0	6.4.0
aquasecurity/trivy-action	0.35.0	0.36.0
actions/dependency-review-action	4.9.0	5.0.0
zizmorcore/zizmor-action	0.5.3	0.5.5

Updates actions/ai-inference from 2.0.7 to 2.1.0

Release notes

Sourced from actions/ai-inference's releases.

v2.1.0

What's Changed

• Add provider: copilot to route inference through GitHub Copilot CLI by @​sgoedecke in actions/ai-inference#221

Full Changelog: actions/ai-inference@v2.0.8...v2.1.0

v2.0.8

What's Changed

• chore(deps-dev): bump fast-xml-parser from 5.2.3 to 5.4.2 by @​dependabot[bot] in actions/ai-inference#182
• Fix CI error: Check Transpiled JavaScript / Check dist by @​johan-j in actions/ai-inference#190
• Security fix mcp token exposure 9299248942858101367 by @​Pet3cy in actions/ai-inference#186
• chore(deps): bump hono from 4.11.3 to 4.12.7 by @​dependabot[bot] in actions/ai-inference#189
• chore(deps): bump openai from 5.11.0 to 6.7.0 by @​dependabot[bot] in actions/ai-inference#140
• chore(deps): bump @​actions/core from 1.11.1 to 2.0.2 by @​dependabot[bot] in actions/ai-inference#161
• chore(deps-dev): bump ajv from 6.12.6 to 6.14.0 by @​dependabot[bot] in actions/ai-inference#181
• chore(deps-dev): bump rollup from 4.43.0 to 4.59.0 by @​dependabot[bot] in actions/ai-inference#179
• chore(deps): bump qs from 6.14.1 to 6.14.2 by @​dependabot[bot] in actions/ai-inference#174
• chore(deps): bump @​modelcontextprotocol/sdk from 1.25.2 to 1.26.0 by @​dependabot[bot] in actions/ai-inference#169
• chore(deps-dev): bump the npm-development group across 1 directory with 11 updates by @​dependabot[bot] in actions/ai-inference#191
• chore(deps): bump the actions-minor group across 1 directory with 3 updates by @​dependabot[bot] in actions/ai-inference#154

New Contributors

• @​johan-j made their first contribution in actions/ai-inference#190
• @​Pet3cy made their first contribution in actions/ai-inference#186

Full Changelog: actions/ai-inference@v2...v2.0.8

Commits

• 17ff458 Merge pull request #221 from actions/sgoedecke/add-copilot-provider
• 3f876c0 Don't include Copilot CLI stderr in error messages; mask token
• 8a3ac87 Bump README example to actions/setup-node@v6 to match repo workflows
• 02820f7 Pass -s to Copilot CLI and document deny-by-default permissions
• 479b2ef Add 'copilot' provider that shells out to GitHub Copilot CLI
• af6ad2c Merge pull request #154 from actions/dependabot/github_actions/actions-minor-...
• 9446d60 chore(deps): bump the actions-minor group across 1 directory with 3 updates
• 9739430 Merge pull request #191 from actions/dependabot/npm_and_yarn/npm-development-...
• e105a5c make it work with new eslint
• 65a8d29 chore(deps-dev): bump the npm-development group across 1 directory with 11 up...
• Additional commits viewable in compare view

Updates github/codeql-action from 4.35.2 to 4.35.5

Release notes

Sourced from github/codeql-action's releases.

v4.35.5

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

v4.35.4

• Update default CodeQL bundle version to 2.25.4. #3881

v4.35.3

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
• Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
• Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
• Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
• Update default CodeQL bundle version to 2.25.3. #3865

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

• Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
• Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
• Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
• Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
• Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795
• The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789
• Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794
• Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807
• Update default CodeQL bundle version to 2.25.2. #3823

4.35.1 - 27 Mar 2026

• Fix incorrect minimum required Git version for improved incremental analysis: it should have been 2.36.0, not 2.11.0. #3781

4.35.0 - 27 Mar 2026

• Reduced the minimum Git version required for improved incremental analysis from 2.38.0 to 2.11.0. #3767
• Update default CodeQL bundle version to 2.25.1. #3773

... (truncated)

Commits

• 9e0d7b8 Merge pull request #3905 from github/update-v4.35.5-d4b485515
• 6d7d599 Add changelog entry for #3899
• 51f7e38 Update changelog for v4.35.5
• d4b4855 Merge pull request #3899 from github/mbg/esbuild/split
• 127de81 Merge remote-tracking branch 'origin/main' into mbg/esbuild/split
• 7fde13f Use src + basename in header to avoid issues on Windows
• dfa61e7 Improve pattern matching and error handling
• 52aafec Import and call runWrapper normally in analyze tests
• 0d08c01 Auto-generate shared bundle
• 14085a6 Auto-generate entry points
• Additional commits viewable in compare view

Updates dependabot/fetch-metadata from 3.0.0 to 3.1.0

Release notes

Sourced from dependabot/fetch-metadata's releases.

v3.1.0

What's Changed

• Add permissions to all workflows by @​truggeri in dependabot/fetch-metadata#687
• build(deps-dev): bump globals from 16.0.0 to 17.4.0 by @​dependabot[bot] in dependabot/fetch-metadata#690
• build(deps-dev): bump esbuild from 0.27.4 to 0.28.0 by @​dependabot[bot] in dependabot/fetch-metadata#693
• build(deps-dev): bump @​hono/node-server from 1.19.10 to 1.19.13 by @​dependabot[bot] in dependabot/fetch-metadata#694
• build(deps-dev): bump hono from 4.12.7 to 4.12.12 by @​dependabot[bot] in dependabot/fetch-metadata#695
• Dynamically update the tracking tag in action by @​truggeri in dependabot/fetch-metadata#696
• fix: handle duplicate dependency names in parseMetadataLinks by @​devantler in dependabot/fetch-metadata#700
• fix: remove $ anchor from updateFragment regex to handle pip directory suffixes by @​devantler in dependabot/fetch-metadata#698
• Updates to README for permissions clarification by @​truggeri in dependabot/fetch-metadata#697
• fix: resolve update-type null for Python, Composer, and Terraform PRs by @​vitorsdcs in dependabot/fetch-metadata#704
• build(deps-dev): bump globals from 17.4.0 to 17.5.0 by @​dependabot[bot] in dependabot/fetch-metadata#703
• build(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1 by @​dependabot[bot] in dependabot/fetch-metadata#701
• build(deps): bump @​actions/github from 9.0.0 to 9.1.0 in the dependencies group across 1 directory by @​dependabot[bot] in dependabot/fetch-metadata#702
• build(deps-dev): bump hono from 4.12.12 to 4.12.14 by @​dependabot[bot] in dependabot/fetch-metadata#705
• v3.1.0 by @​fetch-metadata-action-automation[bot] in dependabot/fetch-metadata#692

New Contributors

• @​devantler made their first contribution in dependabot/fetch-metadata#700
• @​vitorsdcs made their first contribution in dependabot/fetch-metadata#704

Full Changelog: dependabot/fetch-metadata@v3...v3.1.0

Commits

• 25dd0e3 v3.1.0 (#692)
• e073f50 Merge pull request #705 from dependabot/dependabot/npm_and_yarn/hono-4.12.14
• 0670e16 build(deps-dev): bump hono from 4.12.12 to 4.12.14
• 7a7fe10 Merge pull request #702 from dependabot/dependabot/npm_and_yarn/dependencies-...
• 5168191 Updating dist build
• 23882e1 build(deps): bump @​actions/github in the dependencies group
• 1072469 Merge pull request #701 from dependabot/dependabot/github_actions/actions/cre...
• 43f8a00 build(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1
• b4d904a Merge pull request #703 from dependabot/dependabot/npm_and_yarn/globals-17.5.0
• c8046bb build(deps-dev): bump globals from 17.4.0 to 17.5.0
• Additional commits viewable in compare view

Updates actions/labeler from 6.0.1 to 6.1.0

Release notes

Sourced from actions/labeler's releases.

v6.1.0

Enhancements

• Add changed-files-labels-limit and max-files-changed configuration options to cap the number of labels added by @​bluca in actions/labeler#923

Bug Fixes

• Improve Labeler Action documentation and permission error handling by @​chiranjib-swain in actions/labeler#897
• Preserve manually added labels during workflow runs and refine label synchronization logic by @​chiranjib-swain in actions/labeler#917

Dependency Updates

• Upgrade brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v6 by @​dependabot in actions/labeler#877
• Upgrade minimatch from 10.0.1 to 10.2.3 by @​dependabot in actions/labeler#926
• Upgrade dependencies (@​actions/core, @​actions/github, js-yaml, minimatch, @​typescript-eslint) by @​Copilot in actions/labeler#934

New Contributors

• @​chiranjib-swain made their first contribution in actions/labeler#897
• @​bluca made their first contribution in actions/labeler#923
• @​Copilot made their first contribution in actions/labeler#934

Full Changelog: actions/labeler@v6...v6.1.0

Commits

• f27b608 chore: upgrade dependencies (@​actions/core, @​actions/github, js-yaml, minimat...
• c5dadc2 Add 'changed-files-labels-limit' and 'max-files-changed' configs to allow cap...
• e52e4fb Bump minimatch from 10.0.1 to 10.2.3 (#926)
• 77a4082 Fix: Preserve manually added labels during workflow run and refine label sync...
• 25abb3c Improve Labeler Action Documentation and Error Handling for Permissions (#897)
• 395c8cf Bump brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v...
• See full diff in compare view

Updates ruby/setup-ruby from 1.302.0 to 1.307.0

Release notes

Sourced from ruby/setup-ruby's releases.

v1.307.0

What's Changed

• Update README: fix outdated URLs and Ruby version examples by @​fkmy in ruby/setup-ruby#910
• Add ruby-4.0.4 by @​ruby-builder-bot in ruby/setup-ruby#911

Full Changelog: ruby/setup-ruby@v1.306.0...v1.307.0

v1.306.0

What's Changed

• Add truffleruby-34.0.1,truffleruby+graalvm-34.0.1 by @​ruby-builder-bot in ruby/setup-ruby#909

Full Changelog: ruby/setup-ruby@v1.305.0...v1.306.0

v1.305.0

What's Changed

• Update CRuby releases on Windows by @​ruby-builder-bot in ruby/setup-ruby#908

Full Changelog: ruby/setup-ruby@v1.304.0...v1.305.0

v1.304.0

What's Changed

• Add jruby-10.1.0.0 by @​ruby-builder-bot in ruby/setup-ruby#906

Full Changelog: ruby/setup-ruby@v1.303.0...v1.304.0

v1.303.0

What's Changed

• Add ruby-4.0.3 by @​ruby-builder-bot in ruby/setup-ruby#903

Full Changelog: ruby/setup-ruby@v1.302.0...v1.303.0

Commits

• 6aaa311 Add ruby-4.0.4
• f02c009 Fix docs.github.com URLs to avoid 301 redirects
• 98bfeb1 Remove EOL Ruby versions from matrix example in README
• 59a7680 Update Ruby version examples in README to include 4.0
• 6459287 Replace outdated help.github.com URLs with docs.github.com
• c4e5b13 Add truffleruby-34.0.1,truffleruby+graalvm-34.0.1
• 0cb964f Update CRuby releases on Windows
• 94e4d89 Add jruby-10.1.0.0
• 60ecfba Add ruby-4.0.3
• See full diff in compare view

Updates rubygems/configure-rubygems-credentials from 1.0.0 to 2.0.0

Release notes

Sourced from rubygems/configure-rubygems-credentials's releases.

v2.0.0

What's Changed

• Remove oidc test env by @​segiddins in rubygems/configure-rubygems-credentials#219
• npm audit fix by @​segiddins in rubygems/configure-rubygems-credentials#229
• npm audit fix by @​segiddins in rubygems/configure-rubygems-credentials#248
• update yaml & zod by @​segiddins in rubygems/configure-rubygems-credentials#249
• Remove (inaccurate) CODEOWNERS file by @​landongrindheim in rubygems/configure-rubygems-credentials#299
• Teach Dependabot to run weekly by @​landongrindheim in rubygems/configure-rubygems-credentials#300
• Set up github actions linting by @​segiddins in rubygems/configure-rubygems-credentials#303
• 🛠️ Build Dependabot updates by @​landongrindheim in rubygems/configure-rubygems-credentials#298
• Ensure we're not in a detached state when committing by @​landongrindheim in rubygems/configure-rubygems-credentials#304
• Set the remote url (in memory) if a push is needed by @​landongrindheim in rubygems/configure-rubygems-credentials#305
• Use pin hash and latest versions by @​hsbt in rubygems/configure-rubygems-credentials#348
• Fixed assertion message from rubygems.org by @​hsbt in rubygems/configure-rubygems-credentials#353
• Bump @​actions/core from 1.11.1 to 2.0.3 by @​hsbt in rubygems/configure-rubygems-credentials#380
• Improve documentation for role-to-assume by @​hsbt in rubygems/configure-rubygems-credentials#381

New Contributors

• @​landongrindheim made their first contribution in rubygems/configure-rubygems-credentials#299
• @​hsbt made their first contribution in rubygems/configure-rubygems-credentials#348

Full Changelog: rubygems/configure-rubygems-credentials@v1.0.0...v2.0.0

Commits

• 762a4b7 Exclude dependabot updates from release note
• 720fbb1 Merge pull request #401 from rubygems/dependabot/npm_and_yarn/types/node-25.6.0
• 7609dc5 Merge pull request #400 from rubygems/dependabot/npm_and_yarn/typescript-esli...
• 97eb064 Bump @​types/node from 22.9.1 to 25.6.0
• 3561a05 Bump @​typescript-eslint/parser from 8.58.2 to 8.59.1
• cb08873 Merge pull request #394 from rubygems/dependabot/github_actions/zizmorcore/zi...
• aa6ce95 Merge pull request #395 from rubygems/dependabot/github_actions/github/codeql...
• 83bda94 Merge pull request #396 from rubygems/dependabot/npm_and_yarn/eslint-plugin-j...
• a44a37c Merge pull request #397 from rubygems/dependabot/github_actions/actions/setup...
• c99d6f3 Bump actions/setup-node from 6.3.0 to 6.4.0
• Additional commits viewable in compare view

Updates actions/setup-node from 6.3.0 to 6.4.0

Release notes

Sourced from actions/setup-node's releases.

v6.4.0

What's Changed

Dependency updates:

• Upgrade @​actions dependencies by @​Copilot in actions/setup-node#1525
• Update Node.js versions in versions.yml and bump package to v6.4.0 by @​priya-kinthali in actions/setup-node#1533

New Contributors

• @​Copilot made their first contribution in actions/setup-node#1525

Full Changelog: actions/setup-node@v6...v6.4.0

Commits

• 48b55a0 Update Node.js versions in versions.yml and bump package to v6.4.0 (#1533)
• ab72c7e Upgrade @​actions dependencies (#1525)
• See full diff in compare view

Updates aquasecurity/trivy-action from 0.35.0 to 0.36.0

Release notes

Sourced from aquasecurity/trivy-action's releases.

v0.36.0

What's Changed

• chore(ci): update bump-trivy workflow by @​DmitriyLewen in aquasecurity/trivy-action#546
• ci: use action.yaml as single source of truth for Trivy version by @​nikpivkin in aquasecurity/trivy-action#552
• ci: replace peter-evans/create-pull-request with gh CLI by @​nikpivkin in aquasecurity/trivy-action#550
• test: use pinned digests for trivy-db, trivy-java-db and trivy-checks by @​nikpivkin in aquasecurity/trivy-action#555
• ci: add dependabot config by @​nikpivkin in aquasecurity/trivy-action#556
• chore: add zizmor config by @​nikpivkin in aquasecurity/trivy-action#557
• chore(deps): bump the actions group with 5 updates by @​dependabot[bot] in aquasecurity/trivy-action#558
• fix: use portable shebang in entrypoint.sh by @​Hayao0819 in aquasecurity/trivy-action#545
• Fix typo in GOOGLE_APPLICATION_CREDENTIALS env var name by @​patrik-csak in aquasecurity/trivy-action#547
• Upgrade Trivy action version from 0.33.1 to 0.35.0 fixes #549 by @​Aditya09-cse in aquasecurity/trivy-action#548
• chore: use GitHub Actions as git commit author in bump-trivy workflow by @​nikpivkin in aquasecurity/trivy-action#561
• chore(deps): Update trivy to v0.70.0 by @​Argon-DevOps-Mgt in aquasecurity/trivy-action#559
• chore: update action version to v0.36.0 in examples by @​nikpivkin in aquasecurity/trivy-action#563

New Contributors

• @​dependabot[bot] made their first contribution in aquasecurity/trivy-action#558
• @​Hayao0819 made their first contribution in aquasecurity/trivy-action#545
• @​patrik-csak made their first contribution in aquasecurity/trivy-action#547
• @​Aditya09-cse made their first contribution in aquasecurity/trivy-action#548
• @​Argon-DevOps-Mgt made their first contribution in aquasecurity/trivy-action#559

Full Changelog: aquasecurity/trivy-action@v0.35.0...v0.36.0

Commits

• ed142fd chore: update action version to v0.36.0 in examples (#563)
• dea62cf chore(deps): Update trivy to v0.70.0 (#559)
• 128d9a8 chore: use GitHub Actions as git commit author in bump-trivy workflow (#561)
• 876cf04 Upgrade Trivy action version from 0.33.1 to 0.35.0 fixes #549 (#548)
• dada784 Fix typo in GOOGLE_APPLICATION_CREDENTIALS env var name (#547)
• 4a2deec fix: use portable shebang in entrypoint.sh (#545)
• 1994662 chore(deps): bump the actions group with 5 updates (#558)
• 6b36659 chore: add zizmor config (#557)
• 316aa5a ci: add dependabot config (#556)
• 264c9c5 test: use pinned digests for trivy-db, trivy-java-db and trivy-checks (#555)
• Additional commits viewable in compare view

Updates actions/dependency-review-action from 4.9.0 to 5.0.0

Release notes

Sourced from actions/dependency-review-action's releases.

5.0.0

This is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version v2.327.1 to run.

What's Changed

• Add .github/copilot-instructions.md for Copilot coding agent by @​ahpook in actions/dependency-review-action#1067
• Update Node.js runtime from 20 to 24 by @​scottschreckengaust in actions/dependency-review-action#1084
• Bump spdx-license-ids from 3.0.20 to 3.0.23 by @​mongolyy in actions/dependency-review-action#1091
• docs: bump actions/checkout from v4 to v6 in workflow examples by @​Marukome0743 in actions/dependency-review-action#1077
• fix: patched version display for advisories with non-strict semver ranges (e.g. Maven beta versions) by @​tspascoal in actions/dependency-review-action#1076
• Resolve security findings by @​AshelyTC in actions/dependency-review-action#1094
• v5.0.0 release branch by @​ahpook in actions/dependency-review-action#1098

New Contributors

• @​scottschreckengaust made their first contribution in actions/dependency-review-action#1084
• @​mongolyy made their first contribution in actions/dependency-review-action#1091
• @​Marukome0743 made their first contribution in actions/dependency-review-action#1077

Full Changelog: actions/dependency-review-action@v4.9.0...v5.0.0

Commits

• a1d282b Merge pull request #1098 from actions/ahpook/v5-release
• eb6c199 update examples to show @​v5
• 3943c2c v5.0.0 release branch
• 454943c Merge pull request #1094 from actions/ashelytc/security-findings
• 6d92a12 revert @​typescript-eslint/parser update
• a8e5a7e Merge pull request #1076 from tspascoal/fix-version-matching-for-non-string-s...
• b6b7079 update @​typescript-eslint/parser to 8.40.0
• 821a21d update more dependencies
• 05aaaae run npm audit fix
• 55d3e75 Merge pull request #1077 from Marukome0743/docs/checkout
• Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.5.3 to 0.5.5

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.5.5

This is a no-op release.

v0.5.4

• 1.25.0 is now available via the action
• 1.25.0 is now the default version of zizmor used by the action

Commits

• a16621b Bump pins in README (#112)
• 1c03e04 chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 in the github-ac...
• b572f7b Sync zizmor versions (#111)
• 06928c5 chore(deps): bump github/codeql-action in the github-actions group (#109)
• 5ea8b96 docs: Update link to GitHub docs (#108)
• 849ac26 chore(deps): bump the github-actions group with 2 updates (#106)
• 814f977 Bump pins in README (#103)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Summary by cubic

Update pinned GitHub Actions across CI and security workflows to current minor/patch versions. This improves code scanning, dependency review, and runtime support.

• Dependencies

  • Security: github/codeql-action 4.35.5, aquasecurity/trivy-action 0.36.0, actions/dependency-review-action 5.0.0 (Node 24 runtime).
  • Toolchain: actions/setup-node 6.4.0, ruby/setup-ruby 1.307.0, rubygems/configure-rubygems-credentials 2.0.0.
  • Repo automation: actions/labeler 6.1.0, dependabot/fetch-metadata 3.1.0.
  • Other: actions/ai-inference 2.1.0, zizmorcore/zizmor-action 0.5.5.

• Migration

  • Self-hosted runners must be Actions Runner v2.327.1+ to run actions/dependency-review-action v5 (Node 24).

^{Written for commit 4f34b7d. Summary will update on new commits. Review in cubic}

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[github-actions]

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

• .github/workflows/ai-labeler.yml
• .github/workflows/codeql.yml
• .github/workflows/dependabot-auto-merge.yml
• .github/workflows/labeler.yml
• .github/workflows/release-ruby.yml
• .github/workflows/release-typescript.yml
• .github/workflows/scorecard.yml
• .github/workflows/security.yml
• .github/workflows/test.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.