Skip to content
This repository was archived by the owner on Oct 16, 2026. It is now read-only.

chore(deps): bump the github-actions group with 38 updates - #915

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-8cf37b9163
Closed

chore(deps): bump the github-actions group with 38 updates#915
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-8cf37b9163

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 3, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on actions/checkout, dtolnay/rust-toolchain, actions/upload-artifact, actions/setup-java, gradle/actions/setup-gradle, actions/download-artifact, docker/setup-qemu-action, docker/setup-buildx-action, docker/login-action, docker/metadata-action, docker/build-push-action, actions/setup-node, pnpm/action-setup, peter-evans/create-pull-request, dallay/common-actions/.github/workflows/cleanup-cache.yml, github/codeql-action, dallay/common-actions/.github/workflows/dependabot-auto-merge.yml, actions/dependency-review-action, actions/upload-pages-artifact, actions/deploy-pages, github/codeql-action/upload-sarif, actions/github-script, dallay/common-actions/.github/workflows/greetings.yml, actions/create-github-app-token, actions/cache, lycheeverse/lychee-action, actions/cache/save, google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml, google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml, dallay/common-actions/.github/workflows/pr-size-labeler.yml, codecov/codecov-action, googleapis/release-please-action, taiki-e/install-action, gradle/actions/dependency-submission, dallay/common-actions/.github/workflows/semantic-pull-request.yml, SonarSource/sonarqube-scan-action, SonarSource/sonarqube-quality-gate-action and dallay/common-actions/.github/workflows/stale.yml to permit the latest version.
Updates actions/checkout from 6.0.2 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates dtolnay/rust-toolchain to 7e38f4b43b4db5c8dd498af069a4f6196df1d067

Commits

Updates actions/upload-artifact from 4.6.2 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

... (truncated)

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
  • 02a8460 Add proxy integration test
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • Additional commits viewable in compare view

Updates actions/setup-java from 5.2.0 to 6.0.1

Release notes

Sourced from actions/setup-java's releases.

v6.0.1

What's Changed

New Contributors

Full Changelog: actions/setup-java@v6.0.0...v6.0.1

v6.0.0

What's Changed

... (truncated)

Commits
  • de7274f Avoid macOS GPG socket overflow on long runner paths (#1266)
  • 134912a Fix import-safe checks when scripts are run from a path with symlinks (#1265)
  • 0781fc6 Fix alpine failures by switching default back to only warn on verification fa...
  • 4889c4a Fix Temurin EA E2E signature verification (#1260)
  • 8fd3240 [WIP] Fix failing GitHub Actions job for temurin 17 (#1259)
  • 2732291 chore(deps-dev): update eslint and globals (#1256)
  • 1a8f22b chore: streamline Dependabot updates (#1255)
  • 85030b7 docs: complete v6 release highlights (#1254)
  • dd06d9c Prepare documentation for v6 release (#1253)
  • 59b3450 chore(deps): combine open Dependabot npm updates (#1252)
  • Additional commits viewable in compare view

Updates gradle/actions/setup-gradle from 5.0.2 to 6.4.0

Release notes

Sourced from gradle/actions/setup-gradle's releases.

v6.4.0

Highlights

Gradle version support status in the Job Summary

The actions now report the support status of every Gradle version used in a workflow, as job annotations and in the Job Summary (#1057). Thanks to @​ov7a for the contribution.

version kind job annotation version table below the table
End-of-life — two or more major versions behind the latest release warning ⚠️ expandable section naming the affected release lines, pointing at the Gradle Security Subscription
Out of date — one major behind, or more than two minors behind on the current major notice ℹ️ one-line legend pointing at the Gradle release lifecycle docs
Current none — —

Deliberately not reported: patch releases (being on 9.7.0 when 9.7.1 exists is not flagged) and pre-releases (release candidates, milestones and snapshots never produce annotations). The latest Gradle release is determined from the wrapper checksum data already bundled with the action, so no network access is required.

Note that these annotations are emitted independently of the add-job-summary setting: setting add-job-summary: 'never' suppresses the Job Summary itself, but the warning and notice annotations remain.

Gradle itself is now reported in the dependency graph

The dependency-submission action now applies v1.5.0 of the GitHub Dependency Graph Gradle Plugin (up from v1.4.2) (#1069).

The headline change is that the Gradle Build Tool running the build is now reported as an org.gradle:gradle-core dependency, so that GitHub can surface known vulnerabilities in the version of Gradle used to run your build. These are the coordinates that GitHub advisories for the Gradle Build Tool are published against.

Details worth knowing:

  • The entry is always reported as a direct dependency with development scope.
  • It is not affected by the project, configuration or scope filters, so it appears even in graphs that filter aggressively.
  • Expect dependency graphs to gain this one new entry the first time a build runs after upgrading.

A new Gradle signing key, if you use dependency verification

[!IMPORTANT] If your build has dependency verification enabled, you must add a second trusted key before upgrading, or Dependency Graph generation will fail signature verification.

github-dependency-graph-gradle-plugin 1.5.0 is signed with a new Gradle signing subkey, and the key previously documented in our setup guide has been revoked upstream:

... (truncated)

Commits
  • 3f5f9ad Document the new Gradle signing key for dependency verification (#1071)
  • b031f6d [bot] Update dist directory
  • 5bc4175 Bump dependency-graph-gradle-plugin to 1.5.0 (#1069)
  • f3ff59b Combined automated updates: wrapper checksums, npm dependencies, setup-java (...
  • 7927085 Update .tool-versions: node 24.18.0, gradle 9.7.1, java 17 (#1068)
  • c3897a4 [bot] Update dist directory
  • 6b92be1 Update dependencies (#1065)
  • 0d208da [bot] Update dist directory
  • e49d0a3 Report EOL and maintenance status for Gradle versions (#1057)
  • 575435b Use the root-qualified :wrapper task (#1064)
  • Additional commits viewable in compare view

Updates actions/download-artifact from 7.0.0 to 8.0.1

Release notes

Sourced from actions/download-artifact's releases.

v8.0.1

What's Changed

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

Commits
  • 3e5f45b Add regression tests for CJK characters (#471)
  • e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
  • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
  • f258da9 Add change docs
  • ccc058e Fix linting issues
  • bd7976b Add a setting to specify what to do on hash mismatch and default it to error
  • ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
  • 15999bf Add note about package bumps
  • 974686e Bump the version to v8 and add release notes
  • fbe48b1 Update test names to make it clearer what they do
  • Additional commits viewable in compare view

Updates docker/setup-qemu-action from 3.7.0 to 4.4.0

Release notes

Sourced from docker/setup-qemu-action's releases.

v4.4.0

Full Changelog: docker/setup-qemu-action@v4.3.0...v4.4.0

v4.3.0

Full Changelog: docker/setup-qemu-action@v4.2.0...v4.3.0

v4.2.0

Full Changelog: docker/setup-qemu-action@v4.1.0...v4.2.0

v4.1.0

Full Changelog: docker/setup-qemu-action@v4.0.0...v4.1.0

... (truncated)

Commits
  • 9901266 Merge pull request #342 from docker/dependabot/npm_and_yarn/js-yaml-4.3.2
  • 9364d8b Merge pull request #340 from docker/dependabot/npm_and_yarn/humanfs/node-0.16.8
  • 95c3240 Merge pull request #337 from docker/dependabot/npm_and_yarn/postcss-selector-...
  • c24671a Merge pull request #338 from docker/dependabot/github_actions/codeql-actions-...
  • fa83965 Merge pull request #345 from crazy-max/shared-error-helpers
  • f396a65 build(deps): bump the codeql-actions group across 1 directory with 2 updates
  • a63df2f chore: update generated content
  • 3e4165f use the shared error helper for Docker commands
  • 18c52d9 Merge pull request #344 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • 896cbed [dependabot skip] chore: update generated content
  • Additional commits viewable in compare view

Updates docker/setup-buildx-action from 3.12.0 to 4.4.1

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.4.1

Full Changelog: docker/setup-buildx-action@v4.4.0...v4.4.1

v4.4.0

Full Changelog: docker/setup-buildx-action@v4.3.0...v4.4.0

v4.3.0

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

v4.2.0

@dependabot
chore(deps): bump the github-actions group with 38 updates
8b16ce3 
Updates the requirements on [actions/checkout](https://github.com/actions/checkout), [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain), [actions/upload-artifact](https://github.com/actions/upload-artifact), [actions/setup-java](https://github.com/actions/setup-java), [gradle/actions/setup-gradle](https://github.com/gradle/actions), [actions/download-artifact](https://github.com/actions/download-artifact), [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action), [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action), [docker/login-action](https://github.com/docker/login-action), [docker/metadata-action](https://github.com/docker/metadata-action), [docker/build-push-action](https://github.com/docker/build-push-action), [actions/setup-node](https://github.com/actions/setup-node), [pnpm/action-setup](https://github.com/pnpm/action-setup), [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request), [dallay/common-actions/.github/workflows/cleanup-cache.yml](https://github.com/dallay/common-actions), [github/codeql-action](https://github.com/github/codeql-action), [dallay/common-actions/.github/workflows/dependabot-auto-merge.yml](https://github.com/dallay/common-actions), [actions/dependency-review-action](https://github.com/actions/dependency-review-action), [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact), [actions/deploy-pages](https://github.com/actions/deploy-pages), [github/codeql-action/upload-sarif](https://github.com/github/codeql-action), [actions/github-script](https://github.com/actions/github-script), [dallay/common-actions/.github/workflows/greetings.yml](https://github.com/dallay/common-actions), [actions/create-github-app-token](https://github.com/actions/create-github-app-token), [actions/cache](https://github.com/actions/cache), [lycheeverse/lychee-action](https://github.com/lycheeverse/lychee-action), [actions/cache/save](https://github.com/actions/cache), [google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml](https://github.com/google/osv-scanner-action), [google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml](https://github.com/google/osv-scanner-action), [dallay/common-actions/.github/workflows/pr-size-labeler.yml](https://github.com/dallay/common-actions), [codecov/codecov-action](https://github.com/codecov/codecov-action), [googleapis/release-please-action](https://github.com/googleapis/release-please-action), [taiki-e/install-action](https://github.com/taiki-e/install-action), [gradle/actions/dependency-submission](https://github.com/gradle/actions), [dallay/common-actions/.github/workflows/semantic-pull-request.yml](https://github.com/dallay/common-actions), [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action), [SonarSource/sonarqube-quality-gate-action](https://github.com/sonarsource/sonarqube-quality-gate-action) and [dallay/common-actions/.github/workflows/stale.yml](https://github.com/dallay/common-actions) to permit the latest version.

Updates `actions/checkout` from 6.0.2 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@de0fac2...3d3c42e)

Updates `dtolnay/rust-toolchain` to 7e38f4b43b4db5c8dd498af069a4f6196df1d067
- [Release notes](https://github.com/dtolnay/rust-toolchain/releases)
- [Commits](https://github.com/dtolnay/rust-toolchain/commits/7e38f4b43b4db5c8dd498af069a4f6196df1d067)

Updates `actions/upload-artifact` from 4.6.2 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@ea165f8...043fb46)

Updates `actions/setup-java` from 5.2.0 to 6.0.1
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@be666c2...de7274f)

Updates `gradle/actions/setup-gradle` from 5.0.2 to 6.4.0
- [Release notes](https://github.com/gradle/actions/releases)
- [Commits](gradle/actions@0723195...3f5f9ad)

Updates `actions/download-artifact` from 7.0.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@37930b1...3e5f45b)

Updates `docker/setup-qemu-action` from 3.7.0 to 4.4.0
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@c7c5346...9901266)

Updates `docker/setup-buildx-action` from 3.12.0 to 4.4.1
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@8d2750c...f87e599)

Updates `docker/login-action` from 3.7.0 to 4.6.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@c94ce9f...dbcb813)

Updates `docker/metadata-action` from 5.10.0 to 6.2.0
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c299e40...dc80280)

Updates `docker/build-push-action` from 6.19.2 to 7.4.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@10e90e3...c3c9e26)

Updates `actions/setup-node` from 6.3.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@53b8394...8207627)

Updates `pnpm/action-setup` from 4.2.0 to 6.1.0
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@41ff726...ea17c68)

Updates `peter-evans/create-pull-request` from 8.0.0 to 8.1.1
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](peter-evans/create-pull-request@98357b1...5f6978f)

Updates `dallay/common-actions/.github/workflows/cleanup-cache.yml` from 2.0.0 to 2.2.4
- [Release notes](https://github.com/dallay/common-actions/releases)
- [Commits](dallay/common-actions@6ecd716...6906025)

Updates `github/codeql-action` from 3 to 4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v3...v4)

Updates `dallay/common-actions/.github/workflows/dependabot-auto-merge.yml` from 2.0.0 to 2.2.4
- [Release notes](https://github.com/dallay/common-actions/releases)
- [Commits](dallay/common-actions@v2.0.0...v2.2.4)

Updates `actions/dependency-review-action` from 4.8.3 to 5.0.0
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@05fe457...a1d282b)

Updates `actions/upload-pages-artifact` from 4.0.0 to 5.0.0
- [Release notes](https://github.com/actions/upload-pages-artifact/releases)
- [Commits](actions/upload-pages-artifact@7b1f4a7...fc324d3)

Updates `actions/deploy-pages` from 4.0.5 to 5.0.1
- [Release notes](https://github.com/actions/deploy-pages/releases)
- [Commits](actions/deploy-pages@d6db901...368f825)

Updates `github/codeql-action/upload-sarif` from 4.31.10 to 4.38.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdefb33...2892aa5)

Updates `actions/github-script` from 8.0.0 to 9.0.0
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@ed59741...3a2844b)

Updates `dallay/common-actions/.github/workflows/greetings.yml` from 2.0.0 to 2.2.4
- [Release notes](https://github.com/dallay/common-actions/releases)
- [Commits](dallay/common-actions@6ecd716...6906025)

Updates `actions/create-github-app-token` from 2.2.1 to 3.2.0
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](actions/create-github-app-token@v2.2.1...bcd2ba4)

Updates `actions/cache` from 4.2.1 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@0c907a7...55cc834)

Updates `lycheeverse/lychee-action` from 2.8.0 to 2.9.0
- [Release notes](https://github.com/lycheeverse/lychee-action/releases)
- [Commits](lycheeverse/lychee-action@8646ba3...e747777)

Updates `actions/cache/save` from 4.2.1 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@0c907a7...55cc834)

Updates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml` from eb5b619bb565d10623076caba5263750fde3c790 to 8ac9e5ce44cc7178e0e04229a91bdcc003166e57
- [Release notes](https://github.com/google/osv-scanner-action/releases)
- [Commits](google/osv-scanner-action@eb5b619...8ac9e5c)

Updates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml` from eb5b619bb565d10623076caba5263750fde3c790 to 8ac9e5ce44cc7178e0e04229a91bdcc003166e57
- [Release notes](https://github.com/google/osv-scanner-action/releases)
- [Commits](google/osv-scanner-action@eb5b619...8ac9e5c)

Updates `dallay/common-actions/.github/workflows/pr-size-labeler.yml` from 2.0.0 to 2.2.4
- [Release notes](https://github.com/dallay/common-actions/releases)
- [Commits](dallay/common-actions@6ecd716...6906025)

Updates `codecov/codecov-action` from 5.5.3 to 7.1.1
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@1af5884...303a32d)

Updates `googleapis/release-please-action` from 4.4.0 to 5.0.0
- [Release notes](https://github.com/googleapis/release-please-action/releases)
- [Changelog](https://github.com/googleapis/release-please-action/blob/main/CHANGELOG.md)
- [Commits](googleapis/release-please-action@16a9c90...45996ed)

Updates `taiki-e/install-action` from 2.68.14 to 2.87.22
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Commits](taiki-e/install-action@v2.68.14...v2.87.22)

Updates `gradle/actions/dependency-submission` from 5.0.2 to 6.4.0
- [Release notes](https://github.com/gradle/actions/releases)
- [Commits](gradle/actions@0723195...3f5f9ad)

Updates `dallay/common-actions/.github/workflows/semantic-pull-request.yml` from 2.0.0 to 2.2.4
- [Release notes](https://github.com/dallay/common-actions/releases)
- [Commits](dallay/common-actions@v2.0.0...v2.2.4)

Updates `SonarSource/sonarqube-scan-action` from 6.0.0 to 8.3.0
- [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases)
- [Commits](SonarSource/sonarqube-scan-action@fd88b7d...d209202)

Updates `SonarSource/sonarqube-quality-gate-action` from 1.1.0 to 1.2.1
- [Release notes](https://github.com/sonarsource/sonarqube-quality-gate-action/releases)
- [Commits](SonarSource/sonarqube-quality-gate-action@d304d05...7a5fffe)

Updates `dallay/common-actions/.github/workflows/stale.yml` from 2.0.0 to 2.2.4
- [Release notes](https://github.com/dallay/common-actions/releases)
- [Commits](dallay/common-actions@6ecd716...6906025)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: dtolnay/rust-toolchain
  dependency-version: 7e38f4b43b4db5c8dd498af069a4f6196df1d067
  dependency-type: direct:production
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-java
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: gradle/actions/setup-gradle
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: docker/setup-qemu-action
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.4.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: docker/login-action
  dependency-version: 4.6.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: docker/metadata-action
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: docker/build-push-action
  dependency-version: 7.4.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: pnpm/action-setup
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: peter-evans/create-pull-request
  dependency-version: 8.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: dallay/common-actions/.github/workflows/cleanup-cache.yml
  dependency-version: 2.2.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: dallay/common-actions/.github/workflows/dependabot-auto-merge.yml
  dependency-version: 2.2.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/dependency-review-action
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-pages-artifact
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/deploy-pages
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.38.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/github-script
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: dallay/common-actions/.github/workflows/greetings.yml
  dependency-version: 2.2.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/create-github-app-token
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/cache
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: lycheeverse/lychee-action
  dependency-version: 2.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/cache/save
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml
  dependency-version: 8ac9e5ce44cc7178e0e04229a91bdcc003166e57
  dependency-type: direct:production
  dependency-group: github-actions
- dependency-name: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml
  dependency-version: 8ac9e5ce44cc7178e0e04229a91bdcc003166e57
  dependency-type: direct:production
  dependency-group: github-actions
- dependency-name: dallay/common-actions/.github/workflows/pr-size-labeler.yml
  dependency-version: 2.2.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: codecov/codecov-action
  dependency-version: 7.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: googleapis/release-please-action
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: taiki-e/install-action
  dependency-version: 2.87.22
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: gradle/actions/dependency-submission
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: dallay/common-actions/.github/workflows/semantic-pull-request.yml
  dependency-version: 2.2.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: SonarSource/sonarqube-scan-action
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: SonarSource/sonarqube-quality-gate-action
  dependency-version: 1.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: dallay/common-actions/.github/workflows/stale.yml
  dependency-version: 2.2.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added pr|deps Updates or modifies project dependencies pr|infra Changes to build system, tooling, or CI/CD infrastructure type|dependency-upgrade A dependency upgrade labels Oct 3, 2026
@dependabot
dependabot Bot requested a review from yacosta738 as a code owner October 3, 2026 01:52
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 3, 2026

Copy link
Copy Markdown

Deploying corvus with  Cloudflare Pages  Cloudflare Pages

Latest commit: 8b16ce3
Status:⚡️  Build in progress...

View logs

@dependabot dependabot Bot added type|dependency-upgrade A dependency upgrade pr|deps Updates or modifies project dependencies pr|infra Changes to build system, tooling, or CI/CD infrastructure labels Oct 3, 2026
@coderabbitai

coderabbitai Bot commented Oct 3, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Repository: dallay/corvus/.coderabbit.yaml
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 77a93354-945d-42ae-a57f-93aaa9555702

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot added the close|invalid An issue that we don't feel is valid label Oct 3, 2026
@github-actions

github-actions Bot commented Oct 3, 2026

Copy link
Copy Markdown
Contributor

It seems you edited the limitation files. These files aren't open for contributions. If you think they should be, feel free to reply here.

@github-actions github-actions Bot closed this Oct 3, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 3, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@github-actions github-actions Bot added the size/m Denotes a medium change size label Oct 3, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/github-actions-8cf37b9163 branch October 3, 2026 01:52
@github-actions

github-actions Bot commented Oct 3, 2026

Copy link
Copy Markdown
Contributor

Thank you for contributing to this project with this PR, welcome to the community and the amazing world of open source!

semgrep-code-dallay[bot]
semgrep-code-dallay Bot reviewed Oct 3, 2026
View reviewed changes
Comment thread .github/workflows/codeql-analysis.yml
- name: 🔍 Run CodeQL Analysis
if: matrix.language != 'java-kotlin'
uses: github/codeql-action/analyze@v3
uses: github/codeql-action/analyze@v4

@semgrep-code-dallay semgrep-code-dallay Bot Oct 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Medium severity blocking issue identified in your code:

GitHub Actions step uses mutable tag @v4 instead of a pinned commit SHA, allowing the action owner to silently redirect to malicious code and compromise your CI/CD pipeline.

More details about this

The GitHub Actions workflow is using uses: github/codeql-action/analyze@v4, which pins to a mutable tag (v4) rather than a specific commit SHA. This means the action owner can silently redirect what code runs in your workflow without your knowledge.

Here's how an attacker could exploit this:

  1. Compromise the codeql-action repository: An attacker gains write access to the GitHub repository hosting github/codeql-action (or tricks GitHub into transferring ownership).

  2. Repoint the v4 tag: The attacker updates the v4 tag to point to a malicious commit they've created that includes backdoored code (e.g., code that exfiltrates secrets from the GitHub Actions environment).

  3. Your workflow silently runs the backdoor: The next time your workflow runs, GitHub Actions resolves @v4 to the attacker's malicious commit. Your analyze step now runs arbitrary code with access to secrets and repository data.

  4. Extract sensitive data: The malicious github/codeql-action/analyze could steal environment variables containing API keys, access tokens, or commit credentials that were set up for your repository.

This has happened in the real world—the trivy-action and kics-github-action projects both experienced compromises where tags were repointed to inject malicious code into CI/CD pipelines.

To resolve this comment:

✨ Commit fix suggestion
  1. Replace the mutable reference github/codeql-action/analyze@v4 with a full 40-character commit SHA for the v4 release, for example github/codeql-action/analyze@<full-40-character-sha>.
  2. Update both uses: github/codeql-action/analyze@v4 entries in this workflow so they point to the same pinned commit SHA.
  3. Get the correct SHA from the github/codeql-action repository’s v4 release or tags page, and use the exact commit value instead of the tag name. This prevents the action from changing silently if the tag is moved.
  4. Keep the action name and step conditions the same; only change the part after @, for example uses: github/codeql-action/analyze@8ade135a41bc03ea155e62e844d188df1ea18608.
💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

You can view more details about this finding in the Semgrep AppSec Platform.

semgrep-code-dallay[bot]
semgrep-code-dallay Bot reviewed Oct 3, 2026
View reviewed changes
Comment thread .github/workflows/codeql-analysis.yml
if: >
steps.gradle_build_java_kotlin.outcome == 'success'
uses: github/codeql-action/analyze@v3
uses: github/codeql-action/analyze@v4

@semgrep-code-dallay semgrep-code-dallay Bot Oct 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Medium severity blocking issue identified in your code:

GitHub Actions step uses mutable version tag (v4) instead of a specific commit, allowing the action owner to silently update it to malicious code.

More details about this

The github/codeql-action/analyze@v4 action is pinned to a mutable tag (v4) rather than a specific commit hash. An attacker who gains control of the GitHub Actions repository could silently update the v4 tag to point to malicious code. When your workflow runs, it would automatically fetch and execute the attacker's version without any warning or visibility into what changed.

Here's how the attack would work:

  1. An attacker compromises the codeql-action repository or its maintainer credentials
  2. The attacker pushes malicious code and repoints the v4 tag to this new commit
  3. On your next workflow run, the uses: github/codeql-action/analyze@v4 line fetches the malicious version
  4. The malicious code runs with access to your repository secrets, source code, and CI environment
  5. The attacker could exfiltrate credentials, inject backdoors into your build artifacts, or compromise downstream users

This same attack pattern was used to compromise real projects like trivy-action and kics-github-action. The vulnerability exists because mutable tags like v4 can be repointed by the action maintainer at any time, and your workflow has no way to detect or prevent this.

To resolve this comment:

✨ Commit fix suggestion
  1. Replace github/codeql-action/analyze@v4 with a full 40-character commit SHA for the exact v4 release you want to use, for both analyze steps.
  2. Keep the readable version in a comment next to the SHA so future updates are easier, for example: uses: github/codeql-action/analyze@<full-40-char-sha> # v4.x.x.
  3. Pin the matching init step the same way if it is still using @v4, so all github/codeql-action steps use immutable references consistently.
  4. Get the correct SHA from the github/codeql-action release or tag page, and make sure it is the commit that the v4 tag currently points to before updating the workflow.
  5. Manually confirm the workflow still runs the same CodeQL action version after the change by checking the action reference shown in the workflow run. Pinning to a commit SHA prevents the action owner from silently moving a tag or branch to different code later.
💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

You can view more details about this finding in the Semgrep AppSec Platform.

semgrep-code-dallay[bot]
semgrep-code-dallay Bot reviewed Oct 3, 2026
View reviewed changes
Comment thread .github/workflows/codeql-analysis.yml

- name: ⚙️ Initialize CodeQL
uses: github/codeql-action/init@v3
uses: github/codeql-action/init@v4

@semgrep-code-dallay semgrep-code-dallay Bot Oct 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Medium severity blocking issue identified in your code:

GitHub Actions step references mutable version tag @v4 instead of a pinned commit SHA, allowing attackers to silently redirect the action to malicious code and steal repository secrets.

More details about this

The CodeQL action reference uses a mutable version tag (@v4) instead of a pinned commit SHA. An attacker who controls the github/codeql-action repository could silently update the v4 tag to point to malicious code, which would then execute in your workflow with access to your repository secrets and code.

Here's how this could be exploited:

  1. An attacker compromises the github/codeql-action repository or gains control over the v4 tag.
  2. They push malicious code and repoint the v4 tag to a commit containing a backdoor that steals GITHUB_TOKEN or other secrets (stored in secrets.*).
  3. Your workflow runs and automatically pulls the new malicious version at github/codeql-action/init@v4.
  4. The backdoor executes during the "⚙️ Initialize CodeQL" step, exfiltrating secrets or modifying your code before it gets built.
  5. An attacker could then use the stolen GITHUB_TOKEN to push malicious code to your repository or access other workflows.

Similarly, the github/codeql-action/analyze@v4 steps on lines below also use the mutable @v4 tag and face the same risk.

To resolve this comment:

✨ Commit fix suggestion

  1. Replace the mutable ref in the CodeQL init step with a full 40-character commit SHA from the github/codeql-action repository. Change uses: github/codeql-action/init@v4 to uses: github/codeql-action/init@<full-40-character-sha>.

  2. Pin the matching CodeQL analyze steps the same way so the workflow uses one fixed action version consistently. Change uses: github/codeql-action/analyze@v4 to uses: github/codeql-action/analyze@<same-release-full-40-character-sha> if both files come from the same release commit, or to the specific full SHA published for that action entrypoint.

  3. Keep the human-readable version in a comment so future updates are easier to track, for example: uses: github/codeql-action/init@<full-40-character-sha> # v4.x.y. Pinning to a commit SHA prevents a tag like v4 from being silently moved to different code later.

  4. Get the SHA from the official github/codeql-action release you want to trust, then copy that exact commit into the workflow instead of the tag. For example, use the commit shown for the v4 release page or the action's commit URL, not a short SHA.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

You can view more details about this finding in the Semgrep AppSec Platform.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@yacosta738 yacosta738 Awaiting requested review from yacosta738 yacosta738 is a code owner
1 more reviewer
@semgrep-code-dallay semgrep-code-dallay[bot] semgrep-code-dallay[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

close|invalid An issue that we don't feel is valid pr|deps Updates or modifies project dependencies pr|infra Changes to build system, tooling, or CI/CD infrastructure size/m Denotes a medium change size type|dependency-upgrade A dependency upgrade

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants