{"id":10722,"name":"google/osv-scanner-action","ecosystem":"actions","repository_url":"https://github.com/google/osv-scanner-action","issues_count":991,"created_at":"2025-06-06T22:52:02.678Z","updated_at":"2025-06-06T22:52:02.678Z","purl":"pkg:githubactions/google/osv-scanner-action","metadata":{"id":11771809,"name":"google/osv-scanner-action","ecosystem":"actions","description":"Scans your dependencies against the OSV database for vulnerabilties.","homepage":"https://google.github.io/osv-scanner/github-action/","licenses":"apache-2.0","normalized_licenses":["Apache-2.0"],"repository_url":"https://github.com/google/osv-scanner-action","keywords_array":["github-actions","osv","vulnerability-scanners"],"namespace":"google","versions_count":16,"first_release_published_at":"2024-02-02T00:58:52.000Z","latest_release_published_at":"2025-04-03T04:17:44.000Z","latest_release_number":"v2.0.1","last_synced_at":"2025-06-07T21:07:33.740Z","created_at":"2025-06-07T21:07:29.578Z","updated_at":"2025-06-08T20:56:43.265Z","registry_url":"https://github.com/google/osv-scanner-action","install_command":null,"documentation_url":null,"metadata":{"name":"osv-scanner","description":"Scans your dependencies against the OSV database for vulnerabilties.","branding":{"icon":"alert-triangle","color":"red"},"default_branch":"main","path":null},"repo_metadata":{"id":214275967,"uuid":"736073144","full_name":"google/osv-scanner-action","owner":"google","description":null,"archived":false,"fork":false,"pushed_at":"2025-05-05T00:36:23.000Z","size":1312,"stargazers_count":31,"open_issues_count":6,"forks_count":17,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-06-07T21:07:28.321Z","etag":null,"topics":["github-actions","osv","vulnerability-scanners"],"latest_commit_sha":null,"homepage":"https://google.github.io/osv-scanner/github-action/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/google.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-12-26T23:06:54.000Z","updated_at":"2025-06-02T15:24:28.000Z","dependencies_parsed_at":"2023-12-27T05:19:19.196Z","dependency_job_id":"9cb9b373-f9b4-4abf-b929-aaf6e0e7f838","html_url":"https://github.com/google/osv-scanner-action","commit_stats":null,"previous_names":["google/osv-scanner-action"],"tags_count":17,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fosv-scanner-action","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fosv-scanner-action/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fosv-scanner-action/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fosv-scanner-action/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/google","download_url":"https://codeload.github.com/google/osv-scanner-action/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fosv-scanner-action/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":258777197,"owners_count":22756065,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"repo_metadata_updated_at":"2025-06-08T20:56:43.265Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":34.34343434343434,"dependent_packages_count":0.0,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":17.17171717171717},"purl":"pkg:githubactions/google/osv-scanner-action","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/actions/google/osv-scanner-action","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/actions/google/osv-scanner-action","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/actions/google/osv-scanner-action/dependencies","status":null,"funding_links":[],"critical":null,"versions_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/google%2Fosv-scanner-action/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/google%2Fosv-scanner-action/version_numbers","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/google%2Fosv-scanner-action/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/google%2Fosv-scanner-action/related_packages","maintainers":[],"registry":{"name":"github actions","url":"https://github.com/marketplace/actions/","ecosystem":"actions","default":true,"packages_count":31888,"maintainers_count":0,"namespaces_count":20080,"keywords_count":6805,"github":"actions","metadata":{"funded_packages_count":3013},"icon_url":"https://github.com/actions.png","created_at":"2023-01-03T17:16:39.185Z","updated_at":"2025-06-09T06:38:42.709Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/namespaces"}},"unique_repositories_count":335,"unique_repositories_count_past_30_days":8,"recent_issues":[{"uuid":"5416389983","node_id":"PR_kwDOUVAVB88AAAABDCytaw","number":2,"state":"open","title":"Bump the all-actions group with 12 updates","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-09-10T19:21:11.000Z","updated_at":"2026-09-10T19:26:19.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","group_name":"all-actions","update_count":12,"packages":[{"name":"actions/checkout","old_version":"4.4.0","new_version":"7.0.1","repository_url":"https://github.com/actions/checkout"},{"name":"github/codeql-action/init","old_version":"c20e34f438d671fc35777cc9820dd7adf8252874","new_version":"faaca9a8f6edddba5725ffe5adefdab6669a2eca","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/autobuild","old_version":"c20e34f438d671fc35777cc9820dd7adf8252874","new_version":"faaca9a8f6edddba5725ffe5adefdab6669a2eca","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"c20e34f438d671fc35777cc9820dd7adf8252874","new_version":"faaca9a8f6edddba5725ffe5adefdab6669a2eca","repository_url":"https://github.com/github/codeql-action"},{"name":"actions/setup-node","old_version":"4.4.0","new_version":"7.0.0","repository_url":"https://github.com/actions/setup-node"},{"name":"actions/configure-pages","old_version":"5.0.0","new_version":"6.0.0","repository_url":"https://github.com/actions/configure-pages"},{"name":"actions/attest-build-provenance","old_version":"96b4a1ef7235a096b17240c259729fdd70c83d45","new_version":"e8998f949152b193b063cb0ec769d69d929409be","repository_url":"https://github.com/actions/attest-build-provenance"},{"name":"actions/upload-pages-artifact","old_version":"3.0.1","new_version":"5.0.0","repository_url":"https://github.com/actions/upload-pages-artifact"},{"name":"actions/deploy-pages","old_version":"4.0.5","new_version":"5.0.1","repository_url":"https://github.com/actions/deploy-pages"},{"name":"ossf/scorecard-action","old_version":"55891bbd73f2425e97637d96e306fc9d491d0b21","new_version":"2d1146689b8cda280b9bc96326124645441f03bc","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"github/codeql-action/upload-sarif","old_version":"c20e34f438d671fc35777cc9820dd7adf8252874","new_version":"faaca9a8f6edddba5725ffe5adefdab6669a2eca","repository_url":"https://github.com/github/codeql-action"},{"name":"google/osv-scanner-action","old_version":"1.9.2","new_version":"2.5.1","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"[//]: # (dependabot-start)\n⚠️  **Dependabot is rebasing this PR** ⚠️ \n\nRebasing might not happen immediately, so don't worry if this takes some time.\n\nNote: if you make any changes to this PR yourself, they will take precedence over the rebase.\n\n---\n\n[//]: # (dependabot-end)\n\nBumps the all-actions group with 12 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/checkout](https://github.com/actions/checkout) | `4.4.0` | `7.0.1` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `c20e34f438d671fc35777cc9820dd7adf8252874` | `faaca9a8f6edddba5725ffe5adefdab6669a2eca` |\n| [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `c20e34f438d671fc35777cc9820dd7adf8252874` | `faaca9a8f6edddba5725ffe5adefdab6669a2eca` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `c20e34f438d671fc35777cc9820dd7adf8252874` | `faaca9a8f6edddba5725ffe5adefdab6669a2eca` |\n| [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `7.0.0` |\n| [actions/configure-pages](https://github.com/actions/configure-pages) | `5.0.0` | `6.0.0` |\n| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `96b4a1ef7235a096b17240c259729fdd70c83d45` | `e8998f949152b193b063cb0ec769d69d929409be` |\n| [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) | `3.0.1` | `5.0.0` |\n| [actions/deploy-pages](https://github.com/actions/deploy-pages) | `4.0.5` | `5.0.1` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `55891bbd73f2425e97637d96e306fc9d491d0b21` | `2d1146689b8cda280b9bc96326124645441f03bc` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `c20e34f438d671fc35777cc9820dd7adf8252874` | `faaca9a8f6edddba5725ffe5adefdab6669a2eca` |\n| [google/osv-scanner-action](https://github.com/google/osv-scanner-action) | `1.9.2` | `2.5.1` |\n\nUpdates `actions/checkout` from 4.4.0 to 7.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/releases\"\u003eactions/checkout's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eskip running unsafe pr check if input is default by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2518\"\u003eactions/checkout#2518\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003etrim only ascii whitespace for branch by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2521\"\u003eactions/checkout#2521\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eescape values passed to --unset by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2530\"\u003eactions/checkout#2530\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eVarious dependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v7...v7.0.1\"\u003ehttps://github.com/actions/checkout/compare/v7...v7.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eblock checking out fork pr for pull_request_target and workflow_run by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2458\"\u003eactions/checkout#2458\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.1 to 3.4.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2460\"\u003eactions/checkout#2460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.0 to 4.2.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2461\"\u003eactions/checkout#2461\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e and \u003ccode\u003e@​actions/tool-cache\u003c/code\u003e and Remove uuid by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2459\"\u003eactions/checkout#2459\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupgrade module to esm and update dependencies by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2463\"\u003eactions/checkout#2463\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2462\"\u003eactions/checkout#2462\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003egetting ready for checkout v7 release by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2464\"\u003eactions/checkout#2464\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate error wording by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2467\"\u003eactions/checkout#2467\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6.0.3...v7.0.0\"\u003ehttps://github.com/actions/checkout/compare/v6.0.3...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003e[BREAKING]\u003c/strong\u003e backport \u003ccode\u003eallow-unsafe-pr-checkout\u003c/code\u003e to v6 by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2500\"\u003eactions/checkout#2500\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebackport fixes to releases-v6 by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2527\"\u003eactions/checkout#2527\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/\"\u003ehttps://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/\u003c/a\u003e for more details about this breaking change\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6.0.3...v6.1.0\"\u003ehttps://github.com/actions/checkout/compare/v6.0.3...v6.1.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate changelog by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2357\"\u003eactions/checkout#2357\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate changelog for v6.0.3 by \u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2446\"\u003eactions/checkout#2446\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6...v6.0.3\"\u003ehttps://github.com/actions/checkout/compare/v6...v6.0.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by \u003ca href=\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2355\"\u003eactions/checkout#2355\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\"\u003eactions/checkout's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003ch2\u003ev7.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSkip running unsafe pr check if input is default by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2518\"\u003eactions/checkout#2518\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eTrim only ascii whitespace for branch by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2521\"\u003eactions/checkout#2521\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEscape values passed to --unset by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2530\"\u003eactions/checkout#2530\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eVarious dependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBlock checking out fork PR for pull_request_target and workflow_run by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eVarious dependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v4 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2305\"\u003eactions/checkout#2305\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update README.md by \u003ca href=\"https://github.com/motss\"\u003e\u003ccode\u003e@​motss\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1971\"\u003eactions/checkout#1971\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd internal repos for checking out multiple repositories by \u003ca href=\"https://github.com/mouismail\"\u003e\u003ccode\u003e@​mouismail\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1977\"\u003eactions/checkout#1977\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation update - add recommended permissions to Readme by \u003ca href=\"https://github.com/benwells\"\u003e\u003ccode\u003e@​benwells\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2043\"\u003eactions/checkout#2043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdjust positioning of user email note and permissions heading by \u003ca href=\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2044\"\u003eactions/checkout#2044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca href=\"https://github.com/nebuk89\"\u003e\u003ccode\u003e@​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2194\"\u003eactions/checkout#2194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate CODEOWNERS for actions by \u003ca href=\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2224\"\u003eactions/checkout#2224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate package dependencies by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2236\"\u003eactions/checkout#2236\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eurl-helper.ts\u003c/code\u003e now leverages well-known environment variables by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1941\"\u003eactions/checkout#1941\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpand unit test coverage for \u003ccode\u003eisGhes\u003c/code\u003e by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1946\"\u003eactions/checkout#1946\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck out other refs/* by commit if provided, fall back to ref by \u003ca href=\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1924\"\u003eactions/checkout#1924\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1\"\u003e\u003ccode\u003e3d3c42e\u003c/code\u003e\u003c/a\u003e prep v7.0.1 release (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2531\"\u003e#2531\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07\"\u003e\u003ccode\u003e2880268\u003c/code\u003e\u003c/a\u003e escape values passed to --unset (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2530\"\u003e#2530\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1\"\u003e\u003ccode\u003e12cd223\u003c/code\u003e\u003c/a\u003e trim only ascii whitespace for branch (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2521\"\u003e#2521\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541\"\u003e\u003ccode\u003e62661c4\u003c/code\u003e\u003c/a\u003e skip running unsafe pr check if input is default (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2518\"\u003e#2518\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f\"\u003e\u003ccode\u003ee8d4307\u003c/code\u003e\u003c/a\u003e Bump the minor-actions-dependencies group with 2 updates (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2499\"\u003e#2499\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87\"\u003e\u003ccode\u003e631c942\u003c/code\u003e\u003c/a\u003e eslint 9 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2474\"\u003e#2474\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e\"\u003e\u003ccode\u003e4f1f4ae\u003c/code\u003e\u003c/a\u003e Bump actions/upload-artifact from 4 to 7 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2476\"\u003e#2476\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92\"\u003e\u003ccode\u003eba09753\u003c/code\u003e\u003c/a\u003e Bump actions/checkout from 6 to 7 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2488\"\u003e#2488\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22\"\u003e\u003ccode\u003eb9e0990\u003c/code\u003e\u003c/a\u003e Bump docker/login-action from 3.3.0 to 4.2.0 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2479\"\u003e#2479\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2\"\u003e\u003ccode\u003ee8cb398\u003c/code\u003e\u003c/a\u003e Bump docker/build-push-action from 6.5.0 to 7.2.0 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2478\"\u003e#2478\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/checkout/compare/11d5960a326750d5838078e36cf38b85af677262...3d3c42e5aac5ba805825da76410c181273ba90b1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/init` from c20e34f438d671fc35777cc9820dd7adf8252874 to faaca9a8f6edddba5725ffe5adefdab6669a2eca\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.5 - 03 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.4 - 29 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.3 - 22 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.2 - 21 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote=\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4007\"\u003e#4007\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.1 - 16 Jul 2026\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/github/codeql-action/compare/c20e34f438d671fc35777cc9820dd7adf8252874...faaca9a8f6edddba5725ffe5adefdab6669a2eca\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/autobuild` from c20e34f438d671fc35777cc9820dd7adf8252874 to faaca9a8f6edddba5725ffe5adefdab6669a2eca\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/autobuild's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.5 - 03 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.4 - 29 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.3 - 22 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.2 - 21 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote=\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4007\"\u003e#4007\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.1 - 16 Jul 2026\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/github/codeql-action/compare/c20e34f438d671fc35777cc9820dd7adf8252874...faaca9a8f6edddba5725ffe5adefdab6669a2eca\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from c20e34f438d671fc35777cc9820dd7adf8252874 to faaca9a8f6edddba5725ffe5adefdab6669a2eca\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.5 - 03 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.4 - 29 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.3 - 22 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.2 - 21 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote=\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4007\"\u003e#4007\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.1 - 16 Jul 2026\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/github/codeql-action/compare/c20e34f438d671fc35777cc9820dd7adf8252874...faaca9a8f6edddba5725ffe5adefdab6669a2eca\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/setup-node` from 4.4.0 to 7.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/setup-node/releases\"\u003eactions/setup-node's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancements:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd cache-primary-key and cache-matched-key as outputs by \u003ca href=\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e@​gowridurgad\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1577\"\u003eactions/setup-node#1577\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMigrate to ESM and upgrade dependencies by \u003ca href=\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e@​gowridurgad\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1574\"\u003eactions/setup-node#1574\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug fixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRemove dummy NODE_AUTH_TOKEN export by \u003ca href=\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e@​gowridurgad\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1558\"\u003eactions/setup-node#1558\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eOnly use \u003ccode\u003emirrorToken\u003c/code\u003e in \u003ccode\u003egetManifest\u003c/code\u003e if it's provided by \u003ca href=\"https://github.com/deiga\"\u003e\u003ccode\u003e@​deiga\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1548\"\u003eactions/setup-node#1548\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation updates:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd documentation for publishing to npm with Trusted Publisher (OIDC) by \u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1536\"\u003eactions/setup-node#1536\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: Update restore-only cache documentation by \u003ca href=\"https://github.com/priya-kinthali\"\u003e\u003ccode\u003e@​priya-kinthali\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1550\"\u003eactions/setup-node#1550\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: Update caching recommendations to mitigate cache poisoning risks by \u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1567\"\u003eactions/setup-node#1567\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency update:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​actions/cache\u003c/code\u003e to 5.1.0, log cache write denied by \u003ca href=\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1569\"\u003eactions/setup-node#1569\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1536\"\u003eactions/setup-node#1536\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/deiga\"\u003e\u003ccode\u003e@​deiga\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1548\"\u003eactions/setup-node#1548\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1569\"\u003eactions/setup-node#1569\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/setup-node/compare/v6...v7.0.0\"\u003ehttps://github.com/actions/setup-node/compare/v6...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003e@​actions/cache\u003c/code\u003e to 5.1.0 and add security overrides for undici and fast-xml-parser by \u003ca href=\"https://github.com/HarithaVattikuti\"\u003e\u003ccode\u003e@​HarithaVattikuti\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1579\"\u003eactions/setup-node#1579\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0\"\u003ehttps://github.com/actions/setup-node/compare/v6.4.0...v6.5.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.4.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eDependency updates:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ca href=\"https://github.com/actions\"\u003e\u003ccode\u003e@​actions\u003c/code\u003e\u003c/a\u003e dependencies by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1525\"\u003eactions/setup-node#1525\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate Node.js versions in versions.yml and bump package to v6.4.0  by \u003ca href=\"https://github.com/priya-kinthali\"\u003e\u003ccode\u003e@​priya-kinthali\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1533\"\u003eactions/setup-node#1533\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1525\"\u003eactions/setup-node#1525\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/setup-node/compare/v6...v6.4.0\"\u003ehttps://github.com/actions/setup-node/compare/v6...v6.4.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancements:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport parsing \u003ccode\u003edevEngines\u003c/code\u003e field by \u003ca href=\"https://github.com/susnux\"\u003e\u003ccode\u003e@​susnux\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1283\"\u003eactions/setup-node#1283\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/820762786026740c76f36085b0efc47a31fe5020\"\u003e\u003ccode\u003e8207627\u003c/code\u003e\u003c/a\u003e Migrate to ESM and upgrade dependencies (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1574\"\u003e#1574\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/04be95cf3511ea51ebf9f224ddfb99cc7ab87cd4\"\u003e\u003ccode\u003e04be95c\u003c/code\u003e\u003c/a\u003e Add cache-primary-key and cache-matched-key as outputs (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1577\"\u003e#1577\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/7c2c68d20d402ed6a201ada70a81341941093140\"\u003e\u003ccode\u003e7c2c68d\u003c/code\u003e\u003c/a\u003e docs: Update caching recommendations to mitigate cache poisoning risks (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1567\"\u003e#1567\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/6a61c0375d66246de94630495909f12cf8dac84d\"\u003e\u003ccode\u003e6a61c03\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1569\"\u003e#1569\u003c/a\u003e from jasongin/update-actions-cache-5.1.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/30eb73b41ded577900c1ebf968ef95cdf8f7434f\"\u003e\u003ccode\u003e30eb73b\u003c/code\u003e\u003c/a\u003e Resolve high-severity audit issues\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/4e1a87a501d0302f99e30e2748568adcb388d09f\"\u003e\u003ccode\u003e4e1a87a\u003c/code\u003e\u003c/a\u003e Update dist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/360237f0c01778d0c17291f75c56d6feae4f7574\"\u003e\u003ccode\u003e360237f\u003c/code\u003e\u003c/a\u003e Strict equality\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/4f8aac5beb2f0854bc79651567a18c67eb0b9de3\"\u003e\u003ccode\u003e4f8aac5\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/cache\u003c/code\u003e to 5.1.0, log cache write denied\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/f4a67bbeca970f103397d3d2b9462cf787cd2980\"\u003e\u003ccode\u003ef4a67bb\u003c/code\u003e\u003c/a\u003e Only use \u003ccode\u003emirrorToken\u003c/code\u003e in \u003ccode\u003egetManifest\u003c/code\u003e if it's provided (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1548\"\u003e#1548\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/0355742c943ddb13ca8a6b700f824231caa91e75\"\u003e\u003ccode\u003e0355742\u003c/code\u003e\u003c/a\u003e Remove dummy NODE_AUTH_TOKEN export (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1558\"\u003e#1558\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/setup-node/compare/49933ea5288caeca8642d1e84afbd3f7d6820020...820762786026740c76f36085b0efc47a31fe5020\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/configure-pages` from 5.0.0 to 6.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/configure-pages/releases\"\u003eactions/configure-pages's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eupgrade to node 24 \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/186\"\u003e#186\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpgrade IA Publish \u003ca href=\"https://github.com/Jcambass\"\u003e\u003ccode\u003e@​Jcambass\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/165\"\u003e#165\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd workflow file for publishing releases to immutable action package \u003ca href=\"https://github.com/Jcambass\"\u003e\u003ccode\u003e@​Jcambass\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/163\"\u003e#163\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003epin draft release version \u003ca href=\"https://github.com/YiMysty\"\u003e\u003ccode\u003e@​YiMysty\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/162\"\u003e#162\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump espree from 9.6.1 to 10.1.0 \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/160\"\u003e#160\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump eslint-config-prettier from 8.8.0 to 9.1.0 \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/143\"\u003e#143\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBe more friendly to Dependabot \u003ca href=\"https://github.com/yoannchaudet\"\u003e\u003ccode\u003e@​yoannchaudet\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/158\"\u003e#158\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump eslint-plugin-github from 4.10.2 to 5.0.1 \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/154\"\u003e#154\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump braces from 3.0.2 to 3.0.3 in the npm_and_yarn group \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/156\"\u003e#156\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump undici from 5.28.3 to 5.28.4 \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/145\"\u003e#145\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSee details of \u003ca href=\"https://github.com/actions/configure-pages/compare/v5.0.0...v5.0.1\"\u003eall code changes\u003c/a\u003e since previous release.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/45bfe0192ca1faeb007ade9deae92b16b8254a0d\"\u003e\u003ccode\u003e45bfe01\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/186\"\u003e#186\u003c/a\u003e from salmanmkc/node24\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/d8770c2b3b71963902cec525cf516368b4411a78\"\u003e\u003ccode\u003ed8770c2\u003c/code\u003e\u003c/a\u003e Update Node version from 20 to 24 in action.yml\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/cb8a1a32801e6cdb7b111ce13761226bba88f67d\"\u003e\u003ccode\u003ecb8a1a3\u003c/code\u003e\u003c/a\u003e upgrade to node 24\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/d5606572c479bee637007364c6b4800ac4fc8573\"\u003e\u003ccode\u003ed560657\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/165\"\u003e#165\u003c/a\u003e from actions/Jcambass-patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/35e0ac4e4038e070ce9da26f41143bc3cf3c7e1d\"\u003e\u003ccode\u003e35e0ac4\u003c/code\u003e\u003c/a\u003e Upgrade IA Publish\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/1dfbcbff6519463927204dc279c2e0d307824ee2\"\u003e\u003ccode\u003e1dfbcbf\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/163\"\u003e#163\u003c/a\u003e from actions/Jcambass-patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/2f4f988792f75a5edcc39df0e1661f78999e0348\"\u003e\u003ccode\u003e2f4f988\u003c/code\u003e\u003c/a\u003e Add workflow file for publishing releases to immutable action package\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/0d7570ca8762e8c951911e8c9655d8973cc93174\"\u003e\u003ccode\u003e0d7570c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/162\"\u003e#162\u003c/a\u003e from actions/pin-draft-release-verssion\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/3ea19669a5cd11c46d23d6578d088b81fe8527e5\"\u003e\u003ccode\u003e3ea1966\u003c/code\u003e\u003c/a\u003e pin draft release version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/aabcbc432d6b06d1fd5e8bf3cf756880c35e014d\"\u003e\u003ccode\u003eaabcbc4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/160\"\u003e#160\u003c/a\u003e from actions/dependabot/npm_and_yarn/espree-10.1.0\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/configure-pages/compare/983d7736d9b0ae728b81ab479565c72886d7745b...45bfe0192ca1faeb007ade9deae92b16b8254a0d\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/attest-build-provenance` from 96b4a1ef7235a096b17240c259729fdd70c83d45 to e8998f949152b193b063cb0ec769d69d929409be\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md\"\u003eactions/attest-build-provenance's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease Instructions\u003c/h1\u003e\n\u003cp\u003eFollow the steps below to tag a new release for the\n\u003ccode\u003eactions/attest-build-provenance\u003c/code\u003e action.\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e\n\u003cp\u003eCreate a new release for the top-level action using a tag of the form\n\u003ccode\u003evX.X.X\u003c/code\u003e following SemVer conventions:\u003c/p\u003e\n\u003cpre lang=\"shell\"\u003e\u003ccode\u003egh release create vX.X.X\n\u003c/code\u003e\u003c/pre\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eMove (or create) the major version tag to point to the same commit tagged\nabove:\u003c/p\u003e\n\u003cpre lang=\"shell\"\u003e\u003ccode\u003egit tag -fa vX -m \u0026quot;vX\u0026quot;\ngit push origin vX --force\n\u003c/code\u003e\u003c/pre\u003e\n\u003c/li\u003e\n\u003c/ol\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/attest-build-provenance/compare/96b4a1ef7235a096b17240c259729fdd70c83d45...e8998f949152b193b063cb0ec769d69d929409be\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/upload-pages-artifact` from 3.0.1 to 5.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/upload-pages-artifact/releases\"\u003eactions/upload-pages-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate upload-artifact action to version 7 \u003ca href=\"https://github.com/Tom-van-Woudenberg\"\u003e\u003ccode\u003e@​Tom-van-Woudenberg\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/issues/139\"\u003e#139\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efeat: add \u003ccode\u003einclude-hidden-files\u003c/code\u003e input \u003ca href=\"https://github.com/jonchurch\"\u003e\u003ccode\u003e@​jonchurch\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/issues/137\"\u003e#137\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSee details of \u003ca href=\"https://github.com/actions/upload-pages-artifact/compare/v4.0.0...v4.0.1\"\u003eall code changes\u003c/a\u003e since previous release.\u003c/p\u003e\n\u003ch2\u003ev4.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePotentially breaking change: hidden files (specifically dotfiles) will not be included in the artifact by \u003ca href=\"https://github.com/tsusdere\"\u003e\u003ccode\u003e@​tsusdere\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/pull/102\"\u003eactions/upload-pages-artifact#102\u003c/a\u003e\nIf you need to include dotfiles in your artifact: instead of using this action, create your own artifact according to these requirements \u003ca href=\"https://github.com/actions/upload-pages-artifact?tab=readme-ov-file#artifact-validation\"\u003ehttps://github.com/actions/upload-pages-artifact?tab=readme-ov-file#artifact-validation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin \u003ccode\u003eactions/upload-artifact\u003c/code\u003e to SHA by \u003ca href=\"https://github.com/heavymachinery\"\u003e\u003ccode\u003e@​heavymachinery\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/pull/127\"\u003eactions/upload-pages-artifact#127\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-pages-artifact/compare/v3.0.1...v4.0.0\"\u003ehttps://github.com/actions/upload-pages-artifact/compare/v3.0.1...v4.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/fc324d3547104276b827a68afc52ff2a11cc49c9\"\u003e\u003ccode\u003efc324d3\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/issues/139\"\u003e#139\u003c/a\u003e from Tom-van-Woudenberg/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/fe9d4b7d84090e1d8d9c53a0236f810d4e00d2c3\"\u003e\u003ccode\u003efe9d4b7\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/0ca16172ca884f0a37117fed41734f29784cc980\"\u003e\u003ccode\u003e0ca1617\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/issues/137\"\u003e#137\u003c/a\u003e from jonchurch/include-hidden-files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/57f0e8492b437b7818227931fef2faa1a379839b\"\u003e\u003ccode\u003e57f0e84\u003c/code\u003e\u003c/a\u003e Update action.yml\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/4a90348b2933470dc78cec55534259872a6d3c0d\"\u003e\u003ccode\u003e4a90348\u003c/code\u003e\u003c/a\u003e v7 --\u0026gt; hash\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/56f665a6f297fa95f8d735b314187fb2d7764569\"\u003e\u003ccode\u003e56f665a\u003c/code\u003e\u003c/a\u003e Update upload-artifact action to version 7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/f7615f5917213b24245d49ba96693d0f5375a414\"\u003e\u003ccode\u003ef7615f5\u003c/code\u003e\u003c/a\u003e Add \u003ccode\u003einclude-hidden-files\u003c/code\u003e input\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/7b1f4a764d45c48632c6b24a0339c27f5614fb0b\"\u003e\u003ccode\u003e7b1f4a7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/issues/127\"\u003e#127\u003c/a\u003e from heavymachinery/pin-sha\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/4cc19c7d3f3e6c87c68366501382a03c8b1ba6db\"\u003e\u003ccode\u003e4cc19c7\u003c/code\u003e\u003c/a\u003e Pin \u003ccode\u003eactions/upload-artifact\u003c/code\u003e to SHA\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/2d163be3ddce01512f3eea7ac5b7023b5d643ce1\"\u003e\u003ccode\u003e2d163be\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/issues/107\"\u003e#107\u003c/a\u003e from KittyChiu/main\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/upload-pages-artifact/compare/56afc609e74202658d3ffba0e8f6dda462b719fa...fc324d3547104276b827a68afc52ff2a11cc49c9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/deploy-pages` from 4.0.5 to 5.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/deploy-pages/releases\"\u003eactions/deploy-pages's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eAdd backoff and jitter to deployment polling \u003ca href=\"https://github.com/yoannchaudet\"\u003e\u003ccode\u003e@​yoannchaudet\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/444\"\u003e#444\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eImprove deployment request test coverage \u003ca href=\"https://github.com/adwitiyagoyal\"\u003e\u003ccode\u003e@​adwitiyagoyal\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/440\"\u003e#440\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003cp\u003eSee details of \u003ca href=\"https://github.com/actions/deploy-pages/compare/v5.0.0...v5.0.1\"\u003eall code changes\u003c/a\u003e since previous release.\u003c/p\u003e\n\u003cp\u003e:warning: For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the \u003ca href=\"https://github.com/actions/deploy-pages/#compatibility\"\u003ecompatibility table\u003c/a\u003e.\u003c/p\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Node.js version to 24.x \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/404\"\u003e#404\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd workflow file for publishing releases to immutable action package \u003ca href=\"https://github.com/Jcambass\"\u003e\u003ccode\u003e@​Jcambass\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/374\"\u003e#374\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump braces from 3.0.2 to 3.0.3 in the npm_and_yarn group across 1 directory \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/360\"\u003e#360\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eMake the rebuild dist workflow work nicer with Dependabot \u003ca href=\"https://github.com/yoannchaudet\"\u003e\u003ccode\u003e@​yoannchaudet\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/361\"\u003e#361\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump the non-breaking-changes group across 1 directory with 3 updates \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/358\"\u003e#358\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDelete repeated sentence \u003ca href=\"https://github.com/garethsb\"\u003e\u003ccode\u003e@​garethsb\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/359\"\u003e#359\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdate README.md \u003ca href=\"https://github.com/tsusdere\"\u003e\u003ccode\u003e@​tsusdere\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/348\"\u003e#348\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump the non-breaking-changes group with 4 updates \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/341\"\u003e#341\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemove error message for file permissions \u003ca href=\"https://github.com/TooManyBees\"\u003e\u003ccode\u003e@​TooManyBees\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/340\"\u003e#340\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003cp\u003eSee details of \u003ca href=\"https://github.com/actions/deploy-pages/compare/v4.0.5...v4.0.6\"\u003eall code changes\u003c/a\u003e since previous release.\u003c/p\u003e\n\u003cp\u003e:warning: For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the \u003ca href=\"https://github.com/actions/deploy-pages/#compatibility\"\u003ecompatibility table\u003c/a\u003e.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/deploy-pages/commit/368f82528645a54fb793d4d04e342629a3f51346\"\u003e\u003ccode\u003e368f825\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/444\"\u003e#444\u003c/a\u003e from actions/yoannchaudet-deployment-polling-backoff\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/deploy-pages/commit/7e97763d1f8271fc88f351a0c275f37de7f32094\"\u003e\u003ccode\u003e7e97763\u003c/code\u003e\u003c/a\u003e Validate deployment polling intervals\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/deploy-pages/commit/0143e11abb4ace1f6858cb44b2ab99eae8a40b45\"\u003e\u003ccode\u003e0143e11\u003c/code\u003e\u003c/a\u003e Add backoff and jitter to deployment polling\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/deploy-pages/commit/5e98f10ce206463e411e82ac66ef0f2df79c5499\"\u003e\u003ccode\u003e5e98f10\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/440\"\u003e#440\u003c/a\u003e from actions/user/adwitiya\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/deploy-pages/commit/8b0625abb54462fce279dc6ce57ef7ce0fb8b8fc\"\u003e\u003ccode\u003e8b0625a\u003c/code\u003e\u003c/a\u003e Improve deployment request test coverage\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/deploy-pages/commit/cd2ce8fcbc39b97be8ca5fce6e763baed58fa128\"\u003e\u003ccode\u003ecd2ce8f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/404\"\u003e#404\u003c/a\u003e from salmanmkc/node24\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/deploy-pages/commit/bbe2a950ee52d4f5cbe74e6d9d6a8803676e91d5\"\u003e\u003ccode\u003ebbe2a95\u003c/code\u003e\u003c/a\u003e Update Node.js version to 24.x\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/deploy-pages/commit/854d7aa1b99e4509c4d1b53d69b7ba4eaf39215a\"\u003e\u003ccode\u003e854d7aa\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/374\"\u003e#374\u003c/a\u003e from actions/Jcambass-patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/deploy-pages/commit/306bb814f29679fd12f0e4b0014bc1f3a7e7f4bc\"\u003e\u003ccode\u003e306bb81\u003c/code\u003e\u003c/a\u003e Add workflow file for publishing releases to immutable action package\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/deploy-pages/commit/b74272834adc04f971da4b0b055c49fa8d7f90c9\"\u003e\u003ccode\u003eb742728\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/360\"\u003e#360\u003c/a\u003e from actions/dependabot/npm_and_yarn/npm_and_yarn-513...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/deploy-pages/compare/d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e...368f82528645a54fb793d4d04e342629a3f51346\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 55891bbd73f2425e97637d96e306fc9d491d0b21 to 2d1146689b8cda280b9bc96326124645441f03bc\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/RELEASE.md\"\u003eossf/scorecard-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleasing the scorecard GitHub Action\u003c/h1\u003e\n\u003cp\u003eThis is a draft document to describe the release process for the scorecard\nGitHub Action.\u003c/p\u003e\n\u003cp\u003e(If there are improvements you'd like to see, please comment on the\n\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/33\"\u003etracking issue\u003c/a\u003e or issue a\npull request to discuss.)\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#tracking\"\u003eTracking\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#preparing-the-release\"\u003ePreparing the release\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#validate-the-action\"\u003eValidate the Action\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#update-the-scorecard-version\"\u003eUpdate the scorecard version\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#drafting-release-notes\"\u003eDrafting release notes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#release\"\u003eRelease\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#create-a-tag\"\u003eCreate a tag\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#create-a-github-release\"\u003eCreate a GitHub release\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#update-the-starter-workflow\"\u003eUpdate the starter workflow\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#announce\"\u003eAnnounce\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eTracking\u003c/h2\u003e\n\u003cp\u003eAs the first task, a Release Manager should open a tracking issue for the\nrelease.\u003c/p\u003e\n\u003cp\u003eWe don't currently have a template for releasing, but the following\n\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/97\"\u003eissue\u003c/a\u003e is a good example\nto draw inspiration from.\u003c/p\u003e\n\u003cp\u003eWe're not striving for perfection with the template, but the tracking issue\nwill serve as a reference point to aggregate feedback, so try your best to be\nas descriptive as possible.\u003c/p\u003e\n\u003ch2\u003ePreparing the release\u003c/h2\u003e\n\u003cp\u003eThis section covers changes that need to be issued as a pull request and should\nbe merged before releasing the scorecard GitHub Action.\u003c/p\u003e\n\u003ch3\u003eValidate the Action\u003c/h3\u003e\n\u003cp\u003eManually run the workflow \u003ca href=\"https://github.com/ossf/scorecard-action/actions/workflows/scorecards.yml\"\u003escorecards.yml\u003c/a\u003e\nand verify that the run succeeds.\u003c/p\u003e\n\u003ch3\u003eUpdate the scorecard-action version\u003c/h3\u003e\n\u003cp\u003eNOTE: we have a chicken-and-egg problem where the commit to be used for the release\nneeds to have the image tag that only gets created \u003cem\u003eafter\u003c/em\u003e the commit is pushed. We\nworkaround that by pre-selecting and referencing the image tag instead of the SHA which isn't ideal\nbut workable.\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/55891bbd73f2425e97637d96e306fc9d491d0b21...2d1146689b8cda280b9bc96326124645441f03bc\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from c20e34f438d671fc35777cc9820dd7adf8252874 to faaca9a8f6edddba5725ffe5adefdab6669a2eca\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.5 - 03 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.4 - 29 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.3 - 22 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.2 - 21 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote=\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that re...\n\n_Description has been truncated_","html_url":"https://github.com/CristianNichifor/digital-romania-atlas/pull/2","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/CristianNichifor%2Fdigital-romania-atlas/issues/2","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/2/packages"},{"uuid":"5415831181","node_id":"PR_kwDOUVfnxM8AAAABDCWOzQ","number":8,"state":"open","title":"Bump google/osv-scanner-action from 2.0.2 to 2.5.1","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-09-10T18:20:48.000Z","updated_at":"2026-09-10T18:20:49.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"google/osv-scanner-action","old_version":"2.0.2","new_version":"2.5.1","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [google/osv-scanner-action](https://github.com/google/osv-scanner-action) from 2.0.2 to 2.5.1.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.1\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions/checkout action to v7 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/133\"\u003egoogle/osv-scanner-action#133\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve package namespaces when querying osv.dev API (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2978\"\u003e#2978\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eRe-add support for the \u003ccode\u003eOSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY\u003c/code\u003e environment variable (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2983\"\u003e#2983\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eFix local vulnerability matching (\u003ccode\u003e--offline-vulnerabilities\u003c/code\u003e) not working when network capability is \u003ccode\u003eNetworkOnline\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.5.0 as well as:\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: gate reusable workflow outputs with a flag by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/130\"\u003egoogle/osv-scanner-action#130\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin download-artifact action to SHA by \u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add runs-on input to reusable workflows by \u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: address zizmor warnings by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/135\"\u003egoogle/osv-scanner-action#135\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: add GOTOOLCHAIN=auto env to osv-scanner calls by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/138\"\u003egoogle/osv-scanner-action#138\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.5\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.5.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to v2.3.5 by \u003ca href=\"https://github.com/tobyhawker\"\u003e\u003ccode\u003e@​tobyhawker\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/124\"\u003egoogle/osv-scanner-action#124\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tobyhawker\"\u003e\u003ccode\u003e@​tobyhawker\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/124\"\u003egoogle/osv-scanner-action#124\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.3...v2.3.5\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.3...v2.3.5\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.3\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.3.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/6e4298ebc4db23e847df9b2e2de2939d6f066c67\"\u003e\u003ccode\u003e6e4298e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/141\"\u003e#141\u003c/a\u003e from google/update-to-v2.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/5957b4e7a8725730a37d973099c16b9fe44cfc5f\"\u003e\u003ccode\u003e5957b4e\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.1 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/880d9b542cc66d36d91d51b3fbcc038f5f28cfc5\"\u003e\u003ccode\u003e880d9b5\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.1 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/baa4139e56d6312335d899e6ba045fa16d1d3d0b\"\u003e\u003ccode\u003ebaa4139\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.5.1 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f4cfcc01edc9c8b756a9b873b7a623ca674da51e\"\u003e\u003ccode\u003ef4cfcc0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/117\"\u003e#117\u003c/a\u003e from renovate-bot/renovate/workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dfd4cd1d0114e5fc71a6862faf1114ed69d9dca7\"\u003e\u003ccode\u003edfd4cd1\u003c/code\u003e\u003c/a\u003e Update workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/e13f842f8f0b5845b610f16e8a2eb7f22a7f8677\"\u003e\u003ccode\u003ee13f842\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/133\"\u003e#133\u003c/a\u003e from renovate-bot/renovate/major-workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8deb546fdb875b9996d27d4950be7312dac076a1\"\u003e\u003ccode\u003e8deb546\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/140\"\u003e#140\u003c/a\u003e from google/update-to-v2.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8fb3f8c89519ea2c868d3277441ee7fd3c7f15af\"\u003e\u003ccode\u003e8fb3f8c\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.0 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/0c58c542420dfd23fcac08dd9c8ca3cca9c36f1a\"\u003e\u003ccode\u003e0c58c54\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.0 actions\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.0.2...v2.5.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google/osv-scanner-action\u0026package-manager=github_actions\u0026previous-version=2.0.2\u0026new-version=2.5.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/knowmunever-creator/automatic-computing-machine/pull/8","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/knowmunever-creator%2Fautomatic-computing-machine/issues/8","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/8/packages"},{"uuid":"5349766474","node_id":"PR_kwDOTT8pz88AAAABCOApYg","number":21,"state":"closed","title":"chore(deps): bump the actions group across 1 directory with 10 updates","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-09-10T18:54:57.000Z","author_association":null,"state_reason":null,"created_at":"2026-09-04T15:09:43.000Z","updated_at":"2026-09-10T18:55:07.000Z","time_to_close":531914,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"actions","update_count":10,"packages":[{"name":"docker/setup-qemu-action","old_version":"4.2.0","new_version":"4.3.0","repository_url":"https://github.com/docker/setup-qemu-action"},{"name":"docker/setup-buildx-action","old_version":"4.2.0","new_version":"4.3.0","repository_url":"https://github.com/docker/setup-buildx-action"},{"name":"docker/login-action","old_version":"4.4.0","new_version":"4.6.0","repository_url":"https://github.com/docker/login-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.37.0","new_version":"4.37.9","repository_url":"https://github.com/github/codeql-action"},{"name":"actions/setup-go","old_version":"6.5.0","new_version":"7.0.0","repository_url":"https://github.com/actions/setup-go"},{"name":"anchore/sbom-action/download-syft","old_version":"0.24.0","new_version":"0.24.2","repository_url":"https://github.com/anchore/sbom-action"},{"name":"actions/attest-build-provenance","old_version":"4.1.1","new_version":"4.2.2","repository_url":"https://github.com/actions/attest-build-provenance"},{"name":"softprops/action-gh-release","old_version":"3.0.1","new_version":"3.0.3","repository_url":"https://github.com/softprops/action-gh-release"},{"name":"google/osv-scanner-action","old_version":"2.3.8","new_version":"2.5.1","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"ossf/scorecard-action","old_version":"2.4.3","new_version":"2.4.4","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the actions group with 10 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `4.2.0` | `4.3.0` |\n| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.2.0` | `4.3.0` |\n| [docker/login-action](https://github.com/docker/login-action) | `4.4.0` | `4.6.0` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.0` | `4.37.9` |\n| [actions/setup-go](https://github.com/actions/setup-go) | `6.5.0` | `7.0.0` |\n| [anchore/sbom-action/download-syft](https://github.com/anchore/sbom-action) | `0.24.0` | `0.24.2` |\n| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `4.1.1` | `4.2.2` |\n| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.1` | `3.0.3` |\n| [google/osv-scanner-action](https://github.com/google/osv-scanner-action) | `2.3.8` | `2.5.1` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.3` | `2.4.4` |\n\n\nUpdates `docker/setup-qemu-action` from 4.2.0 to 4.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/docker/setup-qemu-action/releases\"\u003edocker/setup-qemu-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.92.0 to 0.96.0 in \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/pull/336\"\u003edocker/setup-qemu-action#336\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​sigstore/verify\u003c/code\u003e from 3.1.0 to 3.1.1 in \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/pull/316\"\u003edocker/setup-qemu-action#316\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump brace-expansion from 1.1.15 to 1.1.18 in \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/pull/332\"\u003edocker/setup-qemu-action#332\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.2.0 to 4.3.1 in \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/pull/334\"\u003edocker/setup-qemu-action#334\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump postcss from 8.5.10 to 8.5.25 in \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/pull/331\"\u003edocker/setup-qemu-action#331\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump sigstore from 4.1.0 to 4.1.1 in \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/pull/317\"\u003edocker/setup-qemu-action#317\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 6.27.0 to 6.28.0 in \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/pull/333\"\u003edocker/setup-qemu-action#333\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/setup-qemu-action/compare/v4.2.0...v4.3.0\"\u003ehttps://github.com/docker/setup-qemu-action/compare/v4.2.0...v4.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-qemu-action/commit/1f40c72289eff860ee54a304f1438e3cff362e0a\"\u003e\u003ccode\u003e1f40c72\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/issues/336\"\u003e#336\u003c/a\u003e from docker/dependabot/npm_and_yarn/docker/actions-to...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-qemu-action/commit/932216e29e2417c3aa0bc5aec3c57089030cef2c\"\u003e\u003ccode\u003e932216e\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-qemu-action/commit/a39e895360e601ae54e9ac97b8ea3b99e5f40491\"\u003e\u003ccode\u003ea39e895\u003c/code\u003e\u003c/a\u003e build(deps): bump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.92.0 to 0.96.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-qemu-action/commit/a98ae9ffe777adf16ca44873bab9926427b262fa\"\u003e\u003ccode\u003ea98ae9f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/issues/333\"\u003e#333\u003c/a\u003e from docker/dependabot/npm_and_yarn/undici-6.28.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-qemu-action/commit/8ebc9d118344dda0af3e25d2a7330010dd33e951\"\u003e\u003ccode\u003e8ebc9d1\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-qemu-action/commit/c41e3fcbc0d6742101e0310c3b008ac3b16a9529\"\u003e\u003ccode\u003ec41e3fc\u003c/code\u003e\u003c/a\u003e build(deps): bump undici from 6.27.0 to 6.28.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-qemu-action/commit/5fc60dfac60f723a3386e73530ff8067f2848f60\"\u003e\u003ccode\u003e5fc60df\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/issues/332\"\u003e#332\u003c/a\u003e from docker/dependabot/npm_and_yarn/brace-expansion-1...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-qemu-action/commit/a26e892bb646b50218299a9b391e7a4b0322d96a\"\u003e\u003ccode\u003ea26e892\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/issues/328\"\u003e#328\u003c/a\u003e from docker/dependabot/github_actions/actions/checkou...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-qemu-action/commit/aa6d04232374700651c6e7be400e859600041423\"\u003e\u003ccode\u003eaa6d042\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/issues/324\"\u003e#324\u003c/a\u003e from docker/dependabot/github_actions/actions/setup-n...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-qemu-action/commit/d381ce5c16de15c000da8929fd1fc6e8fdef19e1\"\u003e\u003ccode\u003ed381ce5\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/issues/317\"\u003e#317\u003c/a\u003e from docker/dependabot/npm_and_yarn/sigstore-4.1.1\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/docker/setup-qemu-action/compare/96fe6ef7f33517b61c61be40b68a1882f3264fb8...1f40c72289eff860ee54a304f1438e3cff362e0a\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `docker/setup-buildx-action` from 4.2.0 to 4.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/docker/setup-buildx-action/releases\"\u003edocker/setup-buildx-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.92.0 to 0.95.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/595\"\u003edocker/setup-buildx-action#595\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump brace-expansion from 1.1.13 to 1.1.18 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/600\"\u003edocker/setup-buildx-action#600\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 5.2.0 to 5.3.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/585\"\u003edocker/setup-buildx-action#585\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump postcss from 8.5.10 to 8.5.25 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/598\"\u003edocker/setup-buildx-action#598\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 6.27.0 to 6.28.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/601\"\u003edocker/setup-buildx-action#601\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/v4.2.0...v4.3.0\"\u003ehttps://github.com/docker/setup-buildx-action/compare/v4.2.0...v4.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/37fe631027851001ddb9b187196cc803df7f5f0e\"\u003e\u003ccode\u003e37fe631\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/595\"\u003e#595\u003c/a\u003e from docker/dependabot/npm_and_yarn/docker/actions-to...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/b5c4f91922681cc7c58d15ab7838986951f09d19\"\u003e\u003ccode\u003eb5c4f91\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/3e93b637c6430ba8fa896fad44d3aa6821899d63\"\u003e\u003ccode\u003e3e93b63\u003c/code\u003e\u003c/a\u003e build(deps): bump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.92.0 to 0.95.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/e527031b32c86649307d5d492506855f90470604\"\u003e\u003ccode\u003ee527031\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/600\"\u003e#600\u003c/a\u003e from docker/dependabot/npm_and_yarn/brace-expansion-1...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/c68814b33cb66f1f7538e546190d410ae557a640\"\u003e\u003ccode\u003ec68814b\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/3f891b01bd5012a434f582800366972569aa1886\"\u003e\u003ccode\u003e3f891b0\u003c/code\u003e\u003c/a\u003e build(deps): bump brace-expansion from 1.1.13 to 1.1.18\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/787db26fcde8ddcabd49a81472318028f7113962\"\u003e\u003ccode\u003e787db26\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/585\"\u003e#585\u003c/a\u003e from docker/dependabot/npm_and_yarn/js-yaml-5.2.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/f7793687c711790ca336bd4934f1b1bf5f778e17\"\u003e\u003ccode\u003ef779368\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/7d5e60413489a33d28077e11d71c668580cfaf8d\"\u003e\u003ccode\u003e7d5e604\u003c/code\u003e\u003c/a\u003e build(deps): bump js-yaml from 5.2.0 to 5.3.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/292c2fb3837a12d3ac2d1e47bbc5c00712bad939\"\u003e\u003ccode\u003e292c2fb\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/590\"\u003e#590\u003c/a\u003e from docker/dependabot/github_actions/actions/setup-n...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/bb05f3f5519dd87d3ba754cc423b652a5edd6d2c...37fe631027851001ddb9b187196cc803df7f5f0e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `docker/login-action` from 4.4.0 to 4.6.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/docker/login-action/releases\"\u003edocker/login-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.6.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eHarden buildx scoped config path handling by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1059\"\u003edocker/login-action#1059\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​aws-sdk/client-ecr\u003c/code\u003e and \u003ccode\u003e@​aws-sdk/client-ecr-public\u003c/code\u003e to 3.1095.0 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1051\"\u003edocker/login-action#1051\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 5.2.1 to 5.2.2 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1057\"\u003edocker/login-action#1057\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump postcss from 8.5.10 to 8.5.22 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1056\"\u003edocker/login-action#1056\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/login-action/compare/v4.5.2...v4.6.0\"\u003ehttps://github.com/docker/login-action/compare/v4.5.2...v4.6.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.5.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSurface Docker Hub OIDC error responses by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1058\"\u003edocker/login-action#1058\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/login-action/compare/v4.5.1...v4.5.2\"\u003ehttps://github.com/docker/login-action/compare/v4.5.1...v4.5.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.5.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSupport \u003ccode\u003edhi.io\u003c/code\u003e as Docker Hub OIDC registry by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1054\"\u003edocker/login-action#1054\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/login-action/compare/v4.5.0...v4.5.1\"\u003ehttps://github.com/docker/login-action/compare/v4.5.0...v4.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.5.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action#docker-hub\"\u003eDocker Hub OIDC\u003c/a\u003e login support by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1048\"\u003edocker/login-action#1048\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​aws-sdk/client-ecr\u003c/code\u003e and \u003ccode\u003e@​aws-sdk/client-ecr-public\u003c/code\u003e to 3.1091.0 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1037\"\u003edocker/login-action#1037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.92.0 to 0.94.0 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1044\"\u003edocker/login-action#1044\u003c/a\u003e \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1050\"\u003edocker/login-action#1050\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump brace-expansion from 1.1.13 to 1.1.16 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1046\"\u003edocker/login-action#1046\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 5.2.0 to 5.2.1 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1038\"\u003edocker/login-action#1038\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/login-action/compare/v4.4.0...v4.5.0\"\u003ehttps://github.com/docker/login-action/compare/v4.4.0...v4.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/dbcb813823bdd20940b903addbd779551569679f\"\u003e\u003ccode\u003edbcb813\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/login-action/issues/1051\"\u003e#1051\u003c/a\u003e from docker/dependabot/npm_and_yarn/aws-sdk-dependen...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/5bcb015ee6ec720ecdeaef2dc1164122e9b209fc\"\u003e\u003ccode\u003e5bcb015\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/b30b2f2d3196c1714318ba0c3c3bec211d949752\"\u003e\u003ccode\u003eb30b2f2\u003c/code\u003e\u003c/a\u003e build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/9087f1e6d666fe0292409e3c819680c18526e108\"\u003e\u003ccode\u003e9087f1e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/login-action/issues/1057\"\u003e#1057\u003c/a\u003e from docker/dependabot/npm_and_yarn/js-yaml-5.2.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/0009830ea169ca16c24c0ea4cac1c325bfa3aee4\"\u003e\u003ccode\u003e0009830\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/23255232d3e43c8f0052d9a0dba82a515a88ce92\"\u003e\u003ccode\u003e2325523\u003c/code\u003e\u003c/a\u003e build(deps): bump js-yaml from 5.2.1 to 5.2.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/4ec1d4a769e8b05a89a7396551dc38b329211688\"\u003e\u003ccode\u003e4ec1d4a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/login-action/issues/1056\"\u003e#1056\u003c/a\u003e from docker/dependabot/npm_and_yarn/postcss-8.5.22\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/5fc99ba47bca274c5a499688f71c7ea79c0ea1b3\"\u003e\u003ccode\u003e5fc99ba\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/login-action/issues/1053\"\u003e#1053\u003c/a\u003e from docker/dependabot/github_actions/aws-actions/co...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/e512bd59d16c53d79ea5c0f0e345fe554453c4bb\"\u003e\u003ccode\u003ee512bd5\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/login-action/issues/1052\"\u003e#1052\u003c/a\u003e from docker/dependabot/github_actions/codeql-actions...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/a146c91b8f371700d323bae808af7cbdc2766ed5\"\u003e\u003ccode\u003ea146c91\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/login-action/issues/1059\"\u003e#1059\u003c/a\u003e from crazy-max/harden-buildx-scope-paths\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/docker/login-action/compare/af1e73f918a031802d376d3c8bbc3fe56130a9b0...dbcb813823bdd20940b903addbd779551569679f\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.37.0 to 4.37.9\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.37.9\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.8\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.37.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.6\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.3\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.37.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote=\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4007\"\u003e#4007\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\"\u003e2.26.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4019\"\u003e#4019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and download the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.5 - 03 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.4 - 29 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.3 - 22 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.2 - 21 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote=\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4007\"\u003e#4007\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.1 - 16 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\"\u003e2.26.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4019\"\u003e#4019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.0 - 08 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/cdf488f595d80d6e07e03d4674febd5ab45fa938\"\u003e\u003ccode\u003ecdf488f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4107\"\u003e#4107\u003c/a\u003e from github/update-v4.37.9-920ba7cd1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7243f38558d187dde99730d224bb47aa26a95306\"\u003e\u003ccode\u003e7243f38\u003c/code\u003e\u003c/a\u003e Update changelog for v4.37.9\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/920ba7cd1596037e042122c00381eb16b397d68e\"\u003e\u003ccode\u003e920ba7c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4106\"\u003e#4106\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ecfa6e16817b8f490bc9a59baa391baf4fa3e3c2\"\u003e\u003ccode\u003eecfa6e1\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/adcdf4a70d247343cf9c29e0f7a6658b51c3a2b1\"\u003e\u003ccode\u003eadcdf4a\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/486fec2a3ea2626afcd8c7e9208b4f515078dd7e\"\u003e\u003ccode\u003e486fec2\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4099\"\u003e#4099\u003c/a\u003e from github/update-supported-enterprise-server-versions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/134624c67b20869c2aaa36dafa726375b78a5d76\"\u003e\u003ccode\u003e134624c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4101\"\u003e#4101\u003c/a\u003e from github/dependabot/npm_and_yarn/npm-minor-457d82...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ff43db8f982a368288f117354fb8d046e937124c\"\u003e\u003ccode\u003eff43db8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4103\"\u003e#4103\u003c/a\u003e from github/mergeback/v4.37.8-to-main-db488dde\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4605e03a74cf891614c4d76f82384a16c1c11816\"\u003e\u003ccode\u003e4605e03\u003c/code\u003e\u003c/a\u003e Rebuild\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/099c869cad6bf3b88657154d4ae47ffed27e632d\"\u003e\u003ccode\u003e099c869\u003c/code\u003e\u003c/a\u003e Update changelog and version after v4.37.8\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...cdf488f595d80d6e07e03d4674febd5ab45fa938\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/setup-go` from 6.5.0 to 7.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/setup-go/releases\"\u003eactions/setup-go's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate to ESM and upgrade dependencies by \u003ca href=\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-go/pull/763\"\u003eactions/setup-go#763\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 by \u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-go/pull/771\"\u003eactions/setup-go#771\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-go/pull/771\"\u003eactions/setup-go#771\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/setup-go/compare/v6...v7.0.0\"\u003ehttps://github.com/actions/setup-go/compare/v6...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-go/commit/b7ad1dad31e06c5925ef5d2fc7ad053ef454303e\"\u003e\u003ccode\u003eb7ad1da\u003c/code\u003e\u003c/a\u003e chore(deps): bump \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 (\u003ca href=\"https://redirect.github.com/actions/setup-go/issues/771\"\u003e#771\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-go/commit/0778a10ce47b5d450cf60fb94fafad4330008a35\"\u003e\u003ccode\u003e0778a10\u003c/code\u003e\u003c/a\u003e Migrate to ESM and upgrade dependencies (\u003ca href=\"https://redirect.github.com/actions/setup-go/issues/763\"\u003e#763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `anchore/sbom-action/download-syft` from 0.24.0 to 0.24.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/anchore/sbom-action/releases\"\u003eanchore/sbom-action/download-syft's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.24.2\u003c/h2\u003e\n\u003ch3\u003eAdded Features\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebump eslint from 10.8.1 to 10.9.0 [\u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/724\"\u003e#724\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eAdditional Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eadd makefile target to bump syft [\u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/620\"\u003e#620\u003c/a\u003e \u003ca href=\"https://github.com/willmurphyscode\"\u003e\u003ccode\u003e@​willmurphyscode\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eupdate zizmor workflow triggers [\u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/624\"\u003e#624\u003c/a\u003e \u003ca href=\"https://github.com/wagoodman\"\u003e\u003ccode\u003e@​wagoodman\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003erequire zizmor security events [\u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/621\"\u003e#621\u003c/a\u003e \u003ca href=\"https://github.com/wagoodman\"\u003e\u003ccode\u003e@​wagoodman\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/anchore/sbom-action/compare/v0.24.0...v0.24.2\"\u003e(Full Changelog)\u003c/a\u003e\u003c/strong\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/3ad7283483fc7af8ff2b4ea19663c2d5ca935e26\"\u003e\u003ccode\u003e3ad7283\u003c/code\u003e\u003c/a\u003e ops: update write permissions for release (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/723\"\u003e#723\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/31f5287d0c257c8bc49b610d01b16bd7c4c89482\"\u003e\u003ccode\u003e31f5287\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump eslint from 10.8.1 to 10.9.0 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/724\"\u003e#724\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/aa80c8c5bd439a416a62804f2151ab38c671a638\"\u003e\u003ccode\u003eaa80c8c\u003c/code\u003e\u003c/a\u003e chore(deps): update Syft to latest release (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/722\"\u003e#722\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/74b54e97f669d9e2e6b728114eac6a92940f9c1c\"\u003e\u003ccode\u003e74b54e9\u003c/code\u003e\u003c/a\u003e chore(deps): bump lodash from 4.17.23 to 4.18.1 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/623\"\u003e#623\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/6b92ff5b2cce1787a99198f282dd8a26d1991449\"\u003e\u003ccode\u003e6b92ff5\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump tsx from 4.23.11 to 4.23.12 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/721\"\u003e#721\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/4f8983b9311d3d896e6bd8a3fb90cf4afde91b5c\"\u003e\u003ccode\u003e4f8983b\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump typescript-eslint from 8.65.0 to 8.67.0 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/719\"\u003e#719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/10f27f499cc07de2496e6ec84c95f019fbbfe061\"\u003e\u003ccode\u003e10f27f4\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump eslint from 10.5.0 to 10.8.1 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/720\"\u003e#720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/249403a067afdb4dc73ece33bce948606f486da1\"\u003e\u003ccode\u003e249403a\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 26.1.0 to 26.2.0 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/718\"\u003e#718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/cbf8daab5ef08eec2b4849d40f2798fae7c50855\"\u003e\u003ccode\u003ecbf8daa\u003c/code\u003e\u003c/a\u003e chore(deps): bump anchore/workflows/.github/workflows/check-gate.yaml (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/693\"\u003e#693\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/6afc7939587b28fc3a3cb96958223f88c7efa864\"\u003e\u003ccode\u003e6afc793\u003c/code\u003e\u003c/a\u003e fix: pin syft install.sh to the release tag being installed (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/716\"\u003e#716\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/anchore/sbom-action/compare/e22c389904149dbc22b58101806040fa8d37a610...3ad7283483fc7af8ff2b4ea19663c2d5ca935e26\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/attest-build-provenance` from 4.1.1 to 4.2.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/attest-build-provenance/releases\"\u003eactions/attest-build-provenance's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.2.2\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!NOTE]\nAs of version 4, \u003ccode\u003eactions/attest-build-provenance\u003c/code\u003e is simply a wrapper on top of \u003ca href=\"https://github.com/actions/attest\"\u003e\u003ccode\u003eactions/attest\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003eExisting applications may continue to use the \u003ccode\u003eattest-build-provenance\u003c/code\u003e action, but new implementations should use \u003ccode\u003eactions/attest\u003c/code\u003e instead.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/attest-build-provenance/pull/862\"\u003eactions/attest-build-provenance#862\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/attest-build-provenance/compare/v4.1.1...v4.2.2\"\u003ehttps://github.com/actions/attest-build-provenance/compare/v4.1.1...v4.2.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/attest-build-provenance/commit/4d101475d8b20a2381f78447822ac1eab6504dd8\"\u003e\u003ccode\u003e4d10147\u003c/code\u003e\u003c/a\u003e Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group (\u003ca href=\"https://redirect.github.com/actions/attest-build-provenance/issues/862\"\u003e#862\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/attest-build-provenance/commit/e3fe62ef559997059fe8380e7d2b4c909e2d65f4\"\u003e\u003ccode\u003ee3fe62e\u003c/code\u003e\u003c/a\u003e Bump the actions-minor group with 2 updates (\u003ca href=\"https://redirect.github.com/actions/attest-build-provenance/issues/860\"\u003e#860\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/attest-build-provenance/compare/0f67c3f4856b2e3261c31976d6725780e5e4c373...4d101475d8b20a2381f78447822ac1eab6504dd8\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `softprops/action-gh-release` from 3.0.1 to 3.0.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/softprops/action-gh-release/releases\"\u003esoftprops/action-gh-release's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.0.3\u003c/h2\u003e\n\u003cp\u003e\u003ccode\u003e3.0.3\u003c/code\u003e is a maintenance release with updated dependencies. It also safely\nclassifies malformed GitHub API errors to avoid secondary failures (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/822\"\u003e#822\u003c/a\u003e).\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eBug fixes 🐛\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: safely classify GitHub API errors by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/822\"\u003esoftprops/action-gh-release#822\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther Changes 🔄\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003edependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev3.0.2\u003c/h2\u003e\n\u003cp\u003e\u003ccode\u003e3.0.2\u003c/code\u003e is a patch release focused on release reliability and compatibility. It\nreuses existing draft releases when publishing prereleases, supports replacing\nrelease assets on Gitea, hardens streamed asset uploads, and provides clearer\nrelease-creation diagnostics. It also includes TypeScript, coverage, and tooling\nmaintenance merged since \u003ccode\u003e3.0.1\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis release fixes \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/795\"\u003e#795\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/438\"\u003e#438\u003c/a\u003e, and \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/803\"\u003e#803\u003c/a\u003e. The upload transport hardening covers the\nhistorical failure reported in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/790\"\u003e#790\u003c/a\u003e, although current hosted Node 24 runners did\nnot reproduce it naturally. The diagnostics work is related to \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/786\"\u003e#786\u003c/a\u003e and does not\nclaim a reproducible release-creation fix.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eExciting New Features 🎉\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efeat: improve release error reporting and test coverage by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/813\"\u003esoftprops/action-gh-release#813\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug fixes 🐛\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: publish existing draft releases as prereleases by \u003ca href=\"https://github.com/godfengliang\"\u003e\u003ccode\u003e@​godfengliang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/801\"\u003esoftprops/action-gh-release#801\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: upload small checksum assets reliably by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/815\"\u003esoftprops/action-gh-release#815\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: replace existing release assets on Gitea by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/816\"\u003esoftprops/action-gh-release#816\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: clarify release creation 404 errors by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/817\"\u003esoftprops/action-gh-release#817\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther Changes 🔄\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): upgrade TypeScript to 7 by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/812\"\u003esoftprops/action-gh-release#812\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): remove unused TypeScript tooling by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/814\"\u003esoftprops/action-gh-release#814\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edependency, Node 24 pin, and CI maintenance merged since \u003ccode\u003e3.0.1\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md\"\u003esoftprops/action-gh-release's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.0.3\u003c/h2\u003e\n\u003cp\u003e\u003ccode\u003e3.0.3\u003c/code\u003e is a maintenance release with updated dependencies. It also safely\nclassifies malformed GitHub API errors to avoid secondary failures (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/822\"\u003e#822\u003c/a\u003e).\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eBug fixes 🐛\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: safely classify GitHub API errors by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/822\"\u003esoftprops/action-gh-release#822\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther Changes 🔄\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003edependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.0.2\u003c/h2\u003e\n\u003cp\u003e\u003ccode\u003e3.0.2\u003c/code\u003e is a patch release focused on release reliability and compatibility. It\nreuses existing draft releases when publishing prereleases, supports replacing\nrelease assets on Gitea, hardens streamed asset uploads, and provides clearer\nrelease-creation diagnostics. It also includes TypeScript, coverage, and tooling\nmaintenance merged since \u003ccode\u003e3.0.1\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis release fixes \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/795\"\u003e#795\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/438\"\u003e#438\u003c/a\u003e, and \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/803\"\u003e#803\u003c/a\u003e. The upload transport hardening covers the\nhistorical failure reported in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/790\"\u003e#790\u003c/a\u003e, although current hosted Node 24 runners did\nnot reproduce it naturally. The diagnostics work is related to \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/786\"\u003e#786\u003c/a\u003e and does not\nclaim a reproducible release-creation fix.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eExciting New Features 🎉\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efeat: improve release error reporting and test coverage by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/813\"\u003esoftprops/action-gh-release#813\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug fixes 🐛\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: publish existing draft releases as prereleases by \u003ca href=\"https://github.com/godfengliang\"\u003e\u003ccode\u003e@​godfengliang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/801\"\u003esoftprops/action-gh-release#801\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: upload small checksum assets reliably by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/815\"\u003esoftprops/action-gh-release#815\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: replace existing release assets on Gitea by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/816\"\u003esoftprops/action-gh-release#816\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: clarify release creation 404 errors by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/817\"\u003esoftprops/action-gh-release#817\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther Changes 🔄\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): upgrade TypeScript to 7 by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/812\"\u003esoftprops/action-gh-release#812\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): remove unused TypeScript tooling by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/814\"\u003esoftprops/action-gh-release#814\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edependency, Node 24 pin, and CI maintenance merged since \u003ccode\u003e3.0.1\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003emaintenance release with updated dependencies\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/softprops/action-gh-release/commit/efb35369e0ad2afab669f228072c1b0d510eae64\"\u003e\u003ccode\u003eefb3536\u003c/code\u003e\u003c/a\u003e release 3.0.3 (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/840\"\u003e#840\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/softprops/action-gh-release/commit/6441963a7597ab67f36fea0287a7ae58a9bfd8fe\"\u003e\u003ccode\u003e6441963\u003c/code\u003e\u003c/a\u003e chore(deps): bump the npm group with 2 updates (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/839\"\u003e#839\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/softprops/action-gh-release/commit/e5ee6bc58a36b838b92fc1217f2e4b414b5abcc8\"\u003e\u003ccode\u003ee5ee6bc\u003c/code\u003e\u003c/a\u003e chore(deps): bump esbuild from 0.28.1 to 0.28.2 in the npm group (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/837\"\u003e#837\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/softprops/action-gh-release/commit/d1e66170d32c9ec7bbcb7fae044d3d686ce304d3\"\u003e\u003ccode\u003ed1e6617\u003c/code\u003e\u003c/a\u003e chore(deps): bump undici from 6.27.0 to 6.28.0 (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/831\"\u003e#831\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/softprops/action-gh-release/commit/64037519ba20f54c01bc1dc90342c929aac5a2fa\"\u003e\u003ccode\u003e6403751\u003c/code\u003e\u003c/a\u003e chore(deps): bump the npm group with 2 updates (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/835\"\u003e#835\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/softprops/action-gh-release/commit/7c7184b6876126a5df15adc5b679dc450a393725\"\u003e\u003ccode\u003e7c7184b\u003c/code\u003e\u003c/a\u003e chore(deps): bump postcss from 8.5.19 to 8.5.25 (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/833\"\u003e#833\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/softprops/action-gh-release/commit/0f3f0d2943676d58f9698b3ab590c2056023d77d\"\u003e\u003ccode\u003e0f3f0d2\u003c/code\u003e\u003c/a\u003e chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/832\"\u003e#832\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/softprops/action-gh-release/commit/77fb938f2f95e717ce6705d2909af527263360a0\"\u003e\u003ccode\u003e77fb938\u003c/code\u003e\u003c/a\u003e chore(deps): bump prettier from 3.9.5 to 3.9.6 in the npm group (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/830\"\u003e#830\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/softprops/action-gh-release/commit/5a6f51711ce2ba103b78f5e9550f810679f11e0e\"\u003e\u003ccode\u003e5a6f517\u003c/code\u003e\u003c/a\u003e chore(deps): bump brace-expansion from 5.0.7 to 5.0.8 (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/828\"\u003e#828\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/softprops/action-gh-release/commit/a3c91c98f80000f5b06c7fc0327c54f51c6ab7d8\"\u003e\u003ccode\u003ea3c91c9\u003c/code\u003e\u003c/a\u003e chore(deps): bump the github-actions group with 2 updates (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/825\"\u003e#825\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/softprops/action-gh-release/compare/718ea10b132b3b2eba29c1007bb80653f286566b...efb35369e0ad2afab669f228072c1b0d510eae64\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action` from 2.3.8 to 2.5.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.1\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions/checkout action to v7 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/133\"\u003egoogle/osv-scanner-action#133\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve package namespaces when querying osv.dev API (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2978\"\u003e#2978\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eRe-add support for the \u003ccode\u003eOSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY\u003c/code\u003e environment variable (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2983\"\u003e#2983\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eFix local vulnerability matching (\u003ccode\u003e--offline-vulnerabilities\u003c/code\u003e) not working when network capability is \u003ccode\u003eNetworkOnline\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.5.0 as well as:\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: gate reusable workflow outputs with a flag by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/130\"\u003egoogle/osv-scanner-action#130\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin download-artifact action to SHA by \u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add runs-on input to reusable workflows by \u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: address zizmor warnings by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/135\"\u003egoogle/osv-scanner-action#135\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: add GOTOOLCHAIN=auto env to osv-scanner calls by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/138\"\u003egoogle/osv-scanner-action#138\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/6e4298ebc4db23e847df9b2e2de2939d6f066c67\"\u003e\u003ccode\u003e6e4298e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/141\"\u003e#141\u003c/a\u003e from google/update-to-v2.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/5957b4e7a8725730a37d973099c16b9fe44cfc5f\"\u003e\u003ccode\u003e5957b4e\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.1 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/880d9b542cc66d36d91d51b3fbcc038f5f28cfc5\"\u003e\u003ccode\u003e880d9b5\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.1 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/baa4139e56d6312335d899e6ba045fa16d1d3d0b\"\u003e\u003ccode\u003ebaa4139\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.5.1 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f4cfcc01edc9c8b756a9b873b7a623ca674da51e\"\u003e\u003ccode\u003ef4cfcc0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/117\"\u003e#117\u003c/a\u003e from renovate-bot/renovate/workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dfd4cd1d0114e5fc71a6862faf1114ed69d9dca7\"\u003e\u003ccode\u003edfd4cd1\u003c/code\u003e\u003c/a\u003e Update workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/e13f842f8f0b5845b610f16e8a2eb7f22a7f8677\"\u003e\u003ccode\u003ee13f842\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/133\"\u003e#133\u003c/a\u003e from renovate-bot/renovate/major-workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8deb546fdb875b9996d27d4950be7312dac076a1\"\u003e\u003ccode\u003e8deb546\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/140\"\u003e#140\u003c/a\u003e from google/update-to-v2.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8fb3f8c89519ea2c868d3277441ee7fd3c7f15af\"\u003e\u003ccode\u003e8fb3f8c\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.0 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/0c58c542420dfd23fcac08dd9c8ca3cca9c36f1a\"\u003e\u003ccode\u003e0c58c54\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.0 actions\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.3 to 2.4.4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.4.4\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the \u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.4.0\"\u003eScorecard v5.4.0 release notes\u003c/a\u003e and the \u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.5.0\"\u003eScorecard v5.5.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003elog POST failures instead of failing entire action by \u003ca href=\"https://github.com/spencerschrock\"\u003e\u003ccode\u003e@​spencerschrock\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1625\"\u003eossf/scorecard-action#1625\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.3...v2.4.4\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.3...v2.4.4\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2d1146689b8cda280b9bc96326124645441f03bc\"\u003e\u003ccode\u003e2d11466\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.4.4 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1688\"\u003e#1688\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/1bd3285473b114fb77ed934c4ba0aea31aa0f866\"\u003e\u003ccode\u003e1bd3285\u003c/code\u003e\u003c/a\u003e :seedling: Bump the docker-images group across 1 directory with 2 updates (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1\"\u003e#1\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/913edce4c1ce57261797e2ddcb74e493d9ce9700\"\u003e\u003ccode\u003e913edce\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/containerd/containerd from 1.7.32 to 1.7.33 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1671\"\u003e#1671\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/0957b8f1c327cafd868bd6bdb7e441c016628783\"\u003e\u003ccode\u003e0957b8f\u003c/code\u003e\u003c/a\u003e :seedling: Bump golang.org/x/net from 0.56.0 to 0.57.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1680\"\u003e#1680\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f0061eb3ff8c4d311e47276c8bcc96e96ed5dc32\"\u003e\u003ccode\u003ef0061eb\u003c/code\u003e\u003c/a\u003e :seedling: Bump google.golang.org/grpc from 1.81.1 to 1.82.1 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1687\"\u003e#1687\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/20ee7324026c52f8d0c4b372a7bf382a01b72ff9\"\u003e\u003ccode\u003e20ee732\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1685\"\u003e#1685\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/9f295ef01b1f77f15b1647c790db825d9577a441\"\u003e\u003ccode\u003e9f295ef\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group with 6 updates (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1686\"\u003e#1686\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/69bf556cea38c0fbe034b2ce923253eca7c4d651\"\u003e\u003ccode\u003e69bf556\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1681\"\u003e#1681\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/94e8b9600123b21167ebf56077904fc6ca421a95\"\u003e\u003ccode\u003e94e8b96\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/rekor from 1.5.0 to 1.5.2 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1673\"\u003e#1673\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/c7a1b37bbc88c32d53056d9071ce2ba0df381dfb\"\u003e\u003ccode\u003ec7a1b37\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/fulcio from 1.8.5 to 1.8.6 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1675\"\u003e#1675\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.3...v2.4.4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/cofob/codex-start/pull/21","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/cofob%2Fcodex-start/issues/21","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/21/packages"},{"uuid":"5349184932","node_id":"PR_kwDOSeiTmc8AAAABCNiMRQ","number":213,"state":"closed","title":"chore(deps): bump the images-minor group with 2 updates","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-09-04T14:36:23.000Z","author_association":null,"state_reason":null,"created_at":"2026-09-04T14:18:03.000Z","updated_at":"2026-09-04T14:36:25.000Z","time_to_close":1100,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"images-minor","update_count":2,"packages":[{"name":"google/osv-scanner-action","old_version":"2.5.0","new_version":"2.5.1","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"github/codeql-action","old_version":"4.37.8","new_version":"4.37.9","repository_url":"https://github.com/github/codeql-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the images-minor group with 2 updates: [google/osv-scanner-action](https://github.com/google/osv-scanner-action) and [github/codeql-action](https://github.com/github/codeql-action).\n\nUpdates `google/osv-scanner-action` from 2.5.0 to 2.5.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.1\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions/checkout action to v7 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/133\"\u003egoogle/osv-scanner-action#133\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve package namespaces when querying osv.dev API (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2978\"\u003e#2978\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eRe-add support for the \u003ccode\u003eOSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY\u003c/code\u003e environment variable (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2983\"\u003e#2983\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eFix local vulnerability matching (\u003ccode\u003e--offline-vulnerabilities\u003c/code\u003e) not working when network capability is \u003ccode\u003eNetworkOnline\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/6e4298ebc4db23e847df9b2e2de2939d6f066c67\"\u003e\u003ccode\u003e6e4298e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/141\"\u003e#141\u003c/a\u003e from google/update-to-v2.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/5957b4e7a8725730a37d973099c16b9fe44cfc5f\"\u003e\u003ccode\u003e5957b4e\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.1 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/880d9b542cc66d36d91d51b3fbcc038f5f28cfc5\"\u003e\u003ccode\u003e880d9b5\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.1 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/baa4139e56d6312335d899e6ba045fa16d1d3d0b\"\u003e\u003ccode\u003ebaa4139\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.5.1 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f4cfcc01edc9c8b756a9b873b7a623ca674da51e\"\u003e\u003ccode\u003ef4cfcc0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/117\"\u003e#117\u003c/a\u003e from renovate-bot/renovate/workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dfd4cd1d0114e5fc71a6862faf1114ed69d9dca7\"\u003e\u003ccode\u003edfd4cd1\u003c/code\u003e\u003c/a\u003e Update workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/e13f842f8f0b5845b610f16e8a2eb7f22a7f8677\"\u003e\u003ccode\u003ee13f842\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/133\"\u003e#133\u003c/a\u003e from renovate-bot/renovate/major-workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3f2e7fe5a8528de51a596a4c89dd68e977012c5d\"\u003e\u003ccode\u003e3f2e7fe\u003c/code\u003e\u003c/a\u003e Update actions/checkout action to v7\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action` from 4.37.8 to 4.37.9\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.37.9\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/cdf488f595d80d6e07e03d4674febd5ab45fa938\"\u003e\u003ccode\u003ecdf488f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4107\"\u003e#4107\u003c/a\u003e from github/update-v4.37.9-920ba7cd1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7243f38558d187dde99730d224bb47aa26a95306\"\u003e\u003ccode\u003e7243f38\u003c/code\u003e\u003c/a\u003e Update changelog for v4.37.9\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/920ba7cd1596037e042122c00381eb16b397d68e\"\u003e\u003ccode\u003e920ba7c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4106\"\u003e#4106\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ecfa6e16817b8f490bc9a59baa391baf4fa3e3c2\"\u003e\u003ccode\u003eecfa6e1\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/adcdf4a70d247343cf9c29e0f7a6658b51c3a2b1\"\u003e\u003ccode\u003eadcdf4a\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/486fec2a3ea2626afcd8c7e9208b4f515078dd7e\"\u003e\u003ccode\u003e486fec2\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4099\"\u003e#4099\u003c/a\u003e from github/update-supported-enterprise-server-versions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/134624c67b20869c2aaa36dafa726375b78a5d76\"\u003e\u003ccode\u003e134624c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4101\"\u003e#4101\u003c/a\u003e from github/dependabot/npm_and_yarn/npm-minor-457d82...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ff43db8f982a368288f117354fb8d046e937124c\"\u003e\u003ccode\u003eff43db8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4103\"\u003e#4103\u003c/a\u003e from github/mergeback/v4.37.8-to-main-db488dde\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4605e03a74cf891614c4d76f82384a16c1c11816\"\u003e\u003ccode\u003e4605e03\u003c/code\u003e\u003c/a\u003e Rebuild\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/099c869cad6bf3b88657154d4ae47ffed27e632d\"\u003e\u003ccode\u003e099c869\u003c/code\u003e\u003c/a\u003e Update changelog and version after v4.37.8\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/v4.37.8...v4.37.9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/livewyer-ops/tamoss/pull/213","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/livewyer-ops%2Ftamoss/issues/213","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/213/packages"},{"uuid":"5324858056","node_id":"PR_kwDOS0rmRM8AAAABB6GCEA","number":194,"state":"closed","title":"Bump the actions group across 1 directory with 5 updates","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-09-04T13:56:19.000Z","author_association":null,"state_reason":null,"created_at":"2026-09-02T13:56:34.000Z","updated_at":"2026-09-04T13:56:21.000Z","time_to_close":172785,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","group_name":"actions","update_count":5,"packages":[{"name":"actions/setup-java","old_version":"5","new_version":"6","repository_url":"https://github.com/actions/setup-java"},{"name":"actions/configure-pages","old_version":"5","new_version":"6","repository_url":"https://github.com/actions/configure-pages"},{"name":"actions/upload-pages-artifact","old_version":"4","new_version":"5","repository_url":"https://github.com/actions/upload-pages-artifact"},{"name":"github/codeql-action","old_version":"4.37.3","new_version":"4.37.9","repository_url":"https://github.com/github/codeql-action"},{"name":"google/osv-scanner-action","old_version":"2.3.8","new_version":"2.5.1","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the actions group with 5 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/setup-java](https://github.com/actions/setup-java) | `5` | `6` |\n| [actions/configure-pages](https://github.com/actions/configure-pages) | `5` | `6` |\n| [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) | `4` | `5` |\n| [github/codeql-action](https://github.com/github/codeql-action) | `4.37.3` | `4.37.9` |\n| [google/osv-scanner-action](https://github.com/google/osv-scanner-action) | `2.3.8` | `2.5.1` |\n\n\nUpdates `actions/setup-java` from 5 to 6\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/setup-java/releases\"\u003eactions/setup-java's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edist: Migrate from Zulu Discovery API to Azul Metadata API by \u003ca href=\"https://github.com/jameswald\"\u003e\u003ccode\u003e@​jameswald\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1010\"\u003eactions/setup-java#1010\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add .mvn/extensions.xml to Maven cache key pattern by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1041\"\u003eactions/setup-java#1041\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMigrate to ESM and upgrade dependencies by \u003ca href=\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1078\"\u003eactions/setup-java#1078\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMap Zulu x86 architecture to i686 for Azul Metadata API by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1079\"\u003eactions/setup-java#1079\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRename jdkFile input to jdk-file with deprecated alias by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1083\"\u003eactions/setup-java#1083\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eInfer distribution from asdf .tool-versions vendor prefix by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1084\"\u003eactions/setup-java#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd Maven compiler problem matcher for javac diagnostics by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1086\"\u003eactions/setup-java#1086\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: expose cache-primary-key output (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/597\"\u003e#597\u003c/a\u003e) by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1088\"\u003eactions/setup-java#1088\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: clarify V6 ESM migration is not a user-facing breaking change by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1090\"\u003eactions/setup-java#1090\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport multi-field Java versions like \u003ccode\u003e18.0.1.1\u003c/code\u003e by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1092\"\u003eactions/setup-java#1092\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: document seeding the Maven cache for plugin dependencies by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1094\"\u003eactions/setup-java#1094\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: clarify Maven cache paths and key hash inputs by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1096\"\u003eactions/setup-java#1096\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport pinning java-version as \u0026quot;latest\u0026quot; by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1093\"\u003eactions/setup-java#1093\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump eslint from 10.6.0 to 10.7.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1101\"\u003eactions/setup-java#1101\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump eslint-plugin-n from 18.2.1 to 18.2.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1103\"\u003eactions/setup-java#1103\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump prettier from 3.9.4 to 3.9.5 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1105\"\u003eactions/setup-java#1105\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump actions/checkout from 6 to 7 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1106\"\u003eactions/setup-java#1106\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 26.1.0 to 26.1.1 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1104\"\u003eactions/setup-java#1104\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edist: Cover Tencent Kona JDK 25 by \u003ca href=\"https://github.com/johnshajiang\"\u003e\u003ccode\u003e@​johnshajiang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1108\"\u003eactions/setup-java#1108\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1102\"\u003eactions/setup-java#1102\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePreserve Maven toolchains across repeated setup-java runs (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1099\"\u003e#1099\u003c/a\u003e) by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1111\"\u003eactions/setup-java#1111\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edist: Support Liberica NIK (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/878\"\u003e#878\u003c/a\u003e) by \u003ca href=\"https://github.com/asm0dey\"\u003e\u003ccode\u003e@​asm0dey\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1112\"\u003eactions/setup-java#1112\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix template injection (zizmor alert \u003ca href=\"https://redirect.github.com/actions/setup-java/issues/118\"\u003e#118\u003c/a\u003e) in e2e-versions.yml by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1114\"\u003eactions/setup-java#1114\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix template injection in e2e-versions.yml (zizmor alert \u003ca href=\"https://redirect.github.com/actions/setup-java/issues/122\"\u003e#122\u003c/a\u003e) by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1120\"\u003eactions/setup-java#1120\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDisable persisted checkout credentials in e2e workflow by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1115\"\u003eactions/setup-java#1115\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: Update recommended configuration for GPG signing by \u003ca href=\"https://github.com/wetneb\"\u003e\u003ccode\u003e@​wetneb\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/608\"\u003eactions/setup-java#608\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCache Maven and Gradle wrapper distributions separately from the dependency cache by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1097\"\u003eactions/setup-java#1097\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConsolidate cache-dependency-path e2e workflow and add maven/sbt coverage by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1124\"\u003eactions/setup-java#1124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUse gpg.passphraseEnvName instead of the deprecated gpg.passphrase server by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1123\"\u003eactions/setup-java#1123\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExtract repeated directory-check assertions into check-dir.sh helper by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1127\"\u003eactions/setup-java#1127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConsolidate duplicate jobs in e2e-versions workflow by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1125\"\u003eactions/setup-java#1125\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUse YAML anchors to reduce boilerplate in e2e-versions workflow by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1126\"\u003eactions/setup-java#1126\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdated msft json for now by \u003ca href=\"https://github.com/jmjaffe37\"\u003e\u003ccode\u003e@​jmjaffe37\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1129\"\u003eactions/setup-java#1129\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument missing action inputs in README by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1130\"\u003eactions/setup-java#1130\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 by \u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1128\"\u003eactions/setup-java#1128\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd an option to disable Java problem matchers by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1133\"\u003eactions/setup-java#1133\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: update setup-java examples by \u003ca href=\"https://github.com/HarithaVattikuti\"\u003e\u003ccode\u003e@​HarithaVattikuti\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1131\"\u003eactions/setup-java#1131\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eClarify credential environment variable inputs by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1134\"\u003eactions/setup-java#1134\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump \u003ccode\u003e@​typescript-eslint/eslint-plugin\u003c/code\u003e from 8.63.0 to 8.64.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1135\"\u003eactions/setup-java#1135\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump actions/setup-python from 6 to 7 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1143\"\u003eactions/setup-java#1143\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump fast-xml-parser from 5.9.3 to 5.10.1 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1142\"\u003eactions/setup-java#1142\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e from 8.64.0 to 8.65.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1138\"\u003eactions/setup-java#1138\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump lint-staged from 17.0.8 to 17.2.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1136\"\u003eactions/setup-java#1136\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1137\"\u003eactions/setup-java#1137\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): fix npm audited vulnerabilities by \u003ca href=\"https://github.com/mhoffrog\"\u003e\u003ccode\u003e@​mhoffrog\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1140\"\u003eactions/setup-java#1140\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix formatting issues in README.md by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1144\"\u003eactions/setup-java#1144\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemediate npm audit findings and rebuild distributions by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1145\"\u003eactions/setup-java#1145\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSet GRAALVM_HOME for GraalVM distributions by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1146\"\u003eactions/setup-java#1146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-java/commit/dd06d9cba3e5552c54d9f8ea23572deb30010f7c\"\u003e\u003ccode\u003edd06d9c\u003c/code\u003e\u003c/a\u003e Prepare documentation for v6 release (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1253\"\u003e#1253\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-java/commit/59b3450628e54f250d3a3bfd413cd68b83bce8ed\"\u003e\u003ccode\u003e59b3450\u003c/code\u003e\u003c/a\u003e chore(deps): combine open Dependabot npm updates (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1252\"\u003e#1252\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-java/commit/b96213d9d21fbd1dd447987fe15dd75fce7f7726\"\u003e\u003ccode\u003eb96213d\u003c/code\u003e\u003c/a\u003e Set default signature verification for supported distributions (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1246\"\u003e#1246\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-java/commit/1dbac3c9e137b6d4d280bae1ae4e9902bb4ce1b9\"\u003e\u003ccode\u003e1dbac3c\u003c/code\u003e\u003c/a\u003e docs: expose contributing guide to GitHub (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1245\"\u003e#1245\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-java/commit/11741d6cfaf82354eb314633583a9ce43399238b\"\u003e\u003ccode\u003e11741d6\u003c/code\u003e\u003c/a\u003e ci: constrain cache e2e job modes (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1244\"\u003e#1244\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-java/commit/ff99aa1c87709f29685194226dae7d9b476c594f\"\u003e\u003ccode\u003eff99aa1\u003c/code\u003e\u003c/a\u003e Fix Oracle macOS E2E version (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1243\"\u003e#1243\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-java/commit/416c6d1e8ab4ffb67a533d502fd7b21f70c5d9ee\"\u003e\u003ccode\u003e416c6d1\u003c/code\u003e\u003c/a\u003e Add Red Hat Build of OpenJDK support (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1241\"\u003e#1241\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-java/commit/5f75b27283990add95cd9c4ceaca74d789324bf7\"\u003e\u003ccode\u003e5f75b27\u003c/code\u003e\u003c/a\u003e Add Maven dependency-resolution repositories (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1240\"\u003e#1240\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-java/commit/a42a52cfb590b0682db41c911da5dc7798ba620e\"\u003e\u003ccode\u003ea42a52c\u003c/code\u003e\u003c/a\u003e Add multiple Maven server credentials (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1239\"\u003e#1239\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-java/commit/fb4abd7a7075173ac733c41f723ac0c47c41ad17\"\u003e\u003ccode\u003efb4abd7\u003c/code\u003e\u003c/a\u003e test: cover JDK 26 from SDKMAN (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1238\"\u003e#1238\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/setup-java/compare/v5...v6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/configure-pages` from 5 to 6\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/configure-pages/releases\"\u003eactions/configure-pages's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eupgrade to node 24 \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/186\"\u003e#186\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpgrade IA Publish \u003ca href=\"https://github.com/Jcambass\"\u003e\u003ccode\u003e@​Jcambass\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/165\"\u003e#165\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd workflow file for publishing releases to immutable action package \u003ca href=\"https://github.com/Jcambass\"\u003e\u003ccode\u003e@​Jcambass\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/163\"\u003e#163\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003epin draft release version \u003ca href=\"https://github.com/YiMysty\"\u003e\u003ccode\u003e@​YiMysty\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/162\"\u003e#162\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump espree from 9.6.1 to 10.1.0 \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/160\"\u003e#160\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump eslint-config-prettier from 8.8.0 to 9.1.0 \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/143\"\u003e#143\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBe more friendly to Dependabot \u003ca href=\"https://github.com/yoannchaudet\"\u003e\u003ccode\u003e@​yoannchaudet\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/158\"\u003e#158\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump eslint-plugin-github from 4.10.2 to 5.0.1 \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/154\"\u003e#154\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump braces from 3.0.2 to 3.0.3 in the npm_and_yarn group \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/156\"\u003e#156\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump undici from 5.28.3 to 5.28.4 \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/145\"\u003e#145\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSee details of \u003ca href=\"https://github.com/actions/configure-pages/compare/v5.0.0...v5.0.1\"\u003eall code changes\u003c/a\u003e since previous release.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/45bfe0192ca1faeb007ade9deae92b16b8254a0d\"\u003e\u003ccode\u003e45bfe01\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/186\"\u003e#186\u003c/a\u003e from salmanmkc/node24\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/d8770c2b3b71963902cec525cf516368b4411a78\"\u003e\u003ccode\u003ed8770c2\u003c/code\u003e\u003c/a\u003e Update Node version from 20 to 24 in action.yml\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/cb8a1a32801e6cdb7b111ce13761226bba88f67d\"\u003e\u003ccode\u003ecb8a1a3\u003c/code\u003e\u003c/a\u003e upgrade to node 24\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/d5606572c479bee637007364c6b4800ac4fc8573\"\u003e\u003ccode\u003ed560657\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/165\"\u003e#165\u003c/a\u003e from actions/Jcambass-patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/35e0ac4e4038e070ce9da26f41143bc3cf3c7e1d\"\u003e\u003ccode\u003e35e0ac4\u003c/code\u003e\u003c/a\u003e Upgrade IA Publish\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/1dfbcbff6519463927204dc279c2e0d307824ee2\"\u003e\u003ccode\u003e1dfbcbf\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/163\"\u003e#163\u003c/a\u003e from actions/Jcambass-patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/2f4f988792f75a5edcc39df0e1661f78999e0348\"\u003e\u003ccode\u003e2f4f988\u003c/code\u003e\u003c/a\u003e Add workflow file for publishing releases to immutable action package\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/0d7570ca8762e8c951911e8c9655d8973cc93174\"\u003e\u003ccode\u003e0d7570c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/162\"\u003e#162\u003c/a\u003e from actions/pin-draft-release-verssion\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/3ea19669a5cd11c46d23d6578d088b81fe8527e5\"\u003e\u003ccode\u003e3ea1966\u003c/code\u003e\u003c/a\u003e pin draft release version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/aabcbc432d6b06d1fd5e8bf3cf756880c35e014d\"\u003e\u003ccode\u003eaabcbc4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/160\"\u003e#160\u003c/a\u003e from actions/dependabot/npm_and_yarn/espree-10.1.0\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/configure-pages/compare/v5...v6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/upload-pages-artifact` from 4 to 5\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/upload-pages-artifact/releases\"\u003eactions/upload-pages-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate upload-artifact action to version 7 \u003ca href=\"https://github.com/Tom-van-Woudenberg\"\u003e\u003ccode\u003e@​Tom-van-Woudenberg\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/issues/139\"\u003e#139\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efeat: add \u003ccode\u003einclude-hidden-files\u003c/code\u003e input \u003ca href=\"https://github.com/jonchurch\"\u003e\u003ccode\u003e@​jonchurch\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/issues/137\"\u003e#137\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSee details of \u003ca href=\"https://github.com/actions/upload-pages-artifact/compare/v4.0.0...v4.0.1\"\u003eall code changes\u003c/a\u003e since previous release.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/fc324d3547104276b827a68afc52ff2a11cc49c9\"\u003e\u003ccode\u003efc324d3\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/issues/139\"\u003e#139\u003c/a\u003e from Tom-van-Woudenberg/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/fe9d4b7d84090e1d8d9c53a0236f810d4e00d2c3\"\u003e\u003ccode\u003efe9d4b7\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/0ca16172ca884f0a37117fed41734f29784cc980\"\u003e\u003ccode\u003e0ca1617\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/issues/137\"\u003e#137\u003c/a\u003e from jonchurch/include-hidden-files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/57f0e8492b437b7818227931fef2faa1a379839b\"\u003e\u003ccode\u003e57f0e84\u003c/code\u003e\u003c/a\u003e Update action.yml\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/4a90348b2933470dc78cec55534259872a6d3c0d\"\u003e\u003ccode\u003e4a90348\u003c/code\u003e\u003c/a\u003e v7 --\u0026gt; hash\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/56f665a6f297fa95f8d735b314187fb2d7764569\"\u003e\u003ccode\u003e56f665a\u003c/code\u003e\u003c/a\u003e Update upload-artifact action to version 7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/f7615f5917213b24245d49ba96693d0f5375a414\"\u003e\u003ccode\u003ef7615f5\u003c/code\u003e\u003c/a\u003e Add \u003ccode\u003einclude-hidden-files\u003c/code\u003e input\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/upload-pages-artifact/compare/v4...v5\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action` from 4.37.3 to 4.37.9\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.37.9\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.8\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.37.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.6\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.5 - 03 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.4 - 29 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/cdf488f595d80d6e07e03d4674febd5ab45fa938\"\u003e\u003ccode\u003ecdf488f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4107\"\u003e#4107\u003c/a\u003e from github/update-v4.37.9-920ba7cd1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7243f38558d187dde99730d224bb47aa26a95306\"\u003e\u003ccode\u003e7243f38\u003c/code\u003e\u003c/a\u003e Update changelog for v4.37.9\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/920ba7cd1596037e042122c00381eb16b397d68e\"\u003e\u003ccode\u003e920ba7c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4106\"\u003e#4106\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ecfa6e16817b8f490bc9a59baa391baf4fa3e3c2\"\u003e\u003ccode\u003eecfa6e1\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/adcdf4a70d247343cf9c29e0f7a6658b51c3a2b1\"\u003e\u003ccode\u003eadcdf4a\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/486fec2a3ea2626afcd8c7e9208b4f515078dd7e\"\u003e\u003ccode\u003e486fec2\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4099\"\u003e#4099\u003c/a\u003e from github/update-supported-enterprise-server-versions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/134624c67b20869c2aaa36dafa726375b78a5d76\"\u003e\u003ccode\u003e134624c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4101\"\u003e#4101\u003c/a\u003e from github/dependabot/npm_and_yarn/npm-minor-457d82...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ff43db8f982a368288f117354fb8d046e937124c\"\u003e\u003ccode\u003eff43db8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4103\"\u003e#4103\u003c/a\u003e from github/mergeback/v4.37.8-to-main-db488dde\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4605e03a74cf891614c4d76f82384a16c1c11816\"\u003e\u003ccode\u003e4605e03\u003c/code\u003e\u003c/a\u003e Rebuild\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/099c869cad6bf3b88657154d4ae47ffed27e632d\"\u003e\u003ccode\u003e099c869\u003c/code\u003e\u003c/a\u003e Update changelog and version after v4.37.8\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/v4.37.3...v4.37.9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action` from 2.3.8 to 2.5.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.1\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions/checkout action to v7 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/133\"\u003egoogle/osv-scanner-action#133\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve package namespaces when querying osv.dev API (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2978\"\u003e#2978\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eRe-add support for the \u003ccode\u003eOSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY\u003c/code\u003e environment variable (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2983\"\u003e#2983\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eFix local vulnerability matching (\u003ccode\u003e--offline-vulnerabilities\u003c/code\u003e) not working when network capability is \u003ccode\u003eNetworkOnline\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.5.0 as well as:\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: gate reusable workflow outputs with a flag by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/130\"\u003egoogle/osv-scanner-action#130\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin download-artifact action to SHA by \u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add runs-on input to reusable workflows by \u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: address zizmor warnings by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/135\"\u003egoogle/osv-scanner-action#135\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: add GOTOOLCHAIN=auto env to osv-scanner calls by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/138\"\u003egoogle/osv-scanner-action#138\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/6e4298ebc4db23e847df9b2e2de2939d6f066c67\"\u003e\u003ccode\u003e6e4298e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/141\"\u003e#141\u003c/a\u003e from google/update-to-v2.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/5957b4e7a8725730a37d973099c16b9fe44cfc5f\"\u003e\u003ccode\u003e5957b4e\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.1 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/880d9b542cc66d36d91d51b3fbcc038f5f28cfc5\"\u003e\u003ccode\u003e880d9b5\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.1 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/baa4139e56d6312335d899e6ba045fa16d1d3d0b\"\u003e\u003ccode\u003ebaa4139\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.5.1 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f4cfcc01edc9c8b756a9b873b7a623ca674da51e\"\u003e\u003ccode\u003ef4cfcc0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/117\"\u003e#117\u003c/a\u003e from renovate-bot/renovate/workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dfd4cd1d0114e5fc71a6862faf1114ed69d9dca7\"\u003e\u003ccode\u003edfd4cd1\u003c/code\u003e\u003c/a\u003e Update workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/e13f842f8f0b5845b610f16e8a2eb7f22a7f8677\"\u003e\u003ccode\u003ee13f842\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/133\"\u003e#133\u003c/a\u003e from renovate-bot/renovate/major-workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8deb546fdb875b9996d27d4950be7312dac076a1\"\u003e\u003ccode\u003e8deb546\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/140\"\u003e#140\u003c/a\u003e from google/update-to-v2.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8fb3f8c89519ea2c868d3277441ee7fd3c7f15af\"\u003e\u003ccode\u003e8fb3f8c\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.0 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/0c58c542420dfd23fcac08dd9c8ca3cca9c36f1a\"\u003e\u003ccode\u003e0c58c54\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.0 actions\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/SelfishCoconut/pictokeyboard/pull/194","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/SelfishCoconut%2Fpictokeyboard/issues/194","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/194/packages"},{"uuid":"5318745897","node_id":"PR_kwDOPaeG-M8AAAABB1OtpA","number":93,"state":"open","title":"chore(ci): bump google/osv-scanner-action from 2.3.5 to 2.5.1","user":"dependabot[bot]","labels":["dependencies","github-actions","configuration","ci","dependabot"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-09-02T01:47:34.000Z","updated_at":"2026-09-02T01:48:21.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(ci)","packages":[{"name":"google/osv-scanner-action","old_version":"2.3.5","new_version":"2.5.1","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [google/osv-scanner-action](https://github.com/google/osv-scanner-action) from 2.3.5 to 2.5.1.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.1\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions/checkout action to v7 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/133\"\u003egoogle/osv-scanner-action#133\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve package namespaces when querying osv.dev API (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2978\"\u003e#2978\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eRe-add support for the \u003ccode\u003eOSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY\u003c/code\u003e environment variable (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2983\"\u003e#2983\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eFix local vulnerability matching (\u003ccode\u003e--offline-vulnerabilities\u003c/code\u003e) not working when network capability is \u003ccode\u003eNetworkOnline\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.5.0 as well as:\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: gate reusable workflow outputs with a flag by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/130\"\u003egoogle/osv-scanner-action#130\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin download-artifact action to SHA by \u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add runs-on input to reusable workflows by \u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: address zizmor warnings by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/135\"\u003egoogle/osv-scanner-action#135\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: add GOTOOLCHAIN=auto env to osv-scanner calls by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/138\"\u003egoogle/osv-scanner-action#138\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/6e4298ebc4db23e847df9b2e2de2939d6f066c67\"\u003e\u003ccode\u003e6e4298e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/141\"\u003e#141\u003c/a\u003e from google/update-to-v2.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/5957b4e7a8725730a37d973099c16b9fe44cfc5f\"\u003e\u003ccode\u003e5957b4e\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.1 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/880d9b542cc66d36d91d51b3fbcc038f5f28cfc5\"\u003e\u003ccode\u003e880d9b5\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.1 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/baa4139e56d6312335d899e6ba045fa16d1d3d0b\"\u003e\u003ccode\u003ebaa4139\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.5.1 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f4cfcc01edc9c8b756a9b873b7a623ca674da51e\"\u003e\u003ccode\u003ef4cfcc0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/117\"\u003e#117\u003c/a\u003e from renovate-bot/renovate/workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dfd4cd1d0114e5fc71a6862faf1114ed69d9dca7\"\u003e\u003ccode\u003edfd4cd1\u003c/code\u003e\u003c/a\u003e Update workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/e13f842f8f0b5845b610f16e8a2eb7f22a7f8677\"\u003e\u003ccode\u003ee13f842\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/133\"\u003e#133\u003c/a\u003e from renovate-bot/renovate/major-workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8deb546fdb875b9996d27d4950be7312dac076a1\"\u003e\u003ccode\u003e8deb546\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/140\"\u003e#140\u003c/a\u003e from google/update-to-v2.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8fb3f8c89519ea2c868d3277441ee7fd3c7f15af\"\u003e\u003ccode\u003e8fb3f8c\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.0 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/0c58c542420dfd23fcac08dd9c8ca3cca9c36f1a\"\u003e\u003ccode\u003e0c58c54\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.0 actions\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.5.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google/osv-scanner-action\u0026package-manager=github_actions\u0026previous-version=2.3.5\u0026new-version=2.5.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/bauer-group/automation-templates/pull/93","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/bauer-group%2Fautomation-templates/issues/93","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/93/packages"},{"uuid":"5298011685","node_id":"PR_kwDOSwL1Vc8AAAABBkpuBw","number":33,"state":"open","title":"chore(deps): bump the all group across 1 directory with 13 updates","user":"dependabot[bot]","labels":["dependencies","github_actions","Workflows / CI"],"assignees":[],"locked":false,"comments_count":9,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-08-31T08:16:40.000Z","updated_at":"2026-09-07T08:15:31.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"all","update_count":13,"packages":[{"name":"actions/checkout","old_version":"4","new_version":"7","repository_url":"https://github.com/actions/checkout"},{"name":"codecov/codecov-action","old_version":"6","new_version":"7","repository_url":"https://github.com/codecov/codecov-action"},{"name":"github/codeql-action/init","old_version":"4.35.2","new_version":"4.37.9","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"4.35.2","new_version":"4.37.9","repository_url":"https://github.com/github/codeql-action"},{"name":"actions/github-script","old_version":"7","new_version":"9","repository_url":"https://github.com/actions/github-script"},{"name":"actions/setup-dotnet","old_version":"5.3.0","new_version":"6.0.0","repository_url":"https://github.com/actions/setup-dotnet"},{"name":"github/codeql-action/upload-sarif","old_version":"4.35.2","new_version":"4.37.9","repository_url":"https://github.com/github/codeql-action"},{"name":"actions/labeler","old_version":"6.1.0","new_version":"7.0.0","repository_url":"https://github.com/actions/labeler"},{"name":"JustinBeckwith/linkinator-action","old_version":"2.4.2","new_version":"2.4.5","repository_url":"https://github.com/justinbeckwith/linkinator-action"},{"name":"google/osv-scanner-action","old_version":"2.3.8","new_version":"2.5.1","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"release-drafter/release-drafter","old_version":"7.3.1","new_version":"7.7.0","repository_url":"https://github.com/release-drafter/release-drafter"},{"name":"actions/setup-java","old_version":"5.2.0","new_version":"6.0.0","repository_url":"https://github.com/actions/setup-java"},{"name":"actions/stale","old_version":"10","new_version":"11","repository_url":"https://github.com/actions/stale"}],"path":null,"ecosystem":"actions"},"body":"Bumps the all group with 13 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/checkout](https://github.com/actions/checkout) | `4` | `7` |\n| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `6` | `7` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.35.2` | `4.37.9` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.35.2` | `4.37.9` |\n| [actions/github-script](https://github.com/actions/github-script) | `7` | `9` |\n| [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `5.3.0` | `6.0.0` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.35.2` | `4.37.9` |\n| [actions/labeler](https://github.com/actions/labeler) | `6.1.0` | `7.0.0` |\n| [JustinBeckwith/linkinator-action](https://github.com/justinbeckwith/linkinator-action) | `2.4.2` | `2.4.5` |\n| [google/osv-scanner-action](https://github.com/google/osv-scanner-action) | `2.3.8` | `2.5.1` |\n| [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) | `7.3.1` | `7.7.0` |\n| [actions/setup-java](https://github.com/actions/setup-java) | `5.2.0` | `6.0.0` |\n| [actions/stale](https://github.com/actions/stale) | `10` | `11` |\n\n\nUpdates `actions/checkout` from 4 to 7\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/releases\"\u003eactions/checkout's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eblock checking out fork pr for pull_request_target and workflow_run by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2458\"\u003eactions/checkout#2458\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.1 to 3.4.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2460\"\u003eactions/checkout#2460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.0 to 4.2.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2461\"\u003eactions/checkout#2461\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e and \u003ccode\u003e@​actions/tool-cache\u003c/code\u003e and Remove uuid by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2459\"\u003eactions/checkout#2459\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupgrade module to esm and update dependencies by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2463\"\u003eactions/checkout#2463\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2462\"\u003eactions/checkout#2462\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003egetting ready for checkout v7 release by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2464\"\u003eactions/checkout#2464\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate error wording by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2467\"\u003eactions/checkout#2467\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6.0.3...v7.0.0\"\u003ehttps://github.com/actions/checkout/compare/v6.0.3...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003e[BREAKING]\u003c/strong\u003e backport \u003ccode\u003eallow-unsafe-pr-checkout\u003c/code\u003e to v6 by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2500\"\u003eactions/checkout#2500\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebackport fixes to releases-v6 by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2527\"\u003eactions/checkout#2527\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/\"\u003ehttps://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/\u003c/a\u003e for more details about this breaking change\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6.0.3...v6.1.0\"\u003ehttps://github.com/actions/checkout/compare/v6.0.3...v6.1.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate changelog by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2357\"\u003eactions/checkout#2357\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate changelog for v6.0.3 by \u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2446\"\u003eactions/checkout#2446\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6...v6.0.3\"\u003ehttps://github.com/actions/checkout/compare/v6...v6.0.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by \u003ca href=\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2355\"\u003eactions/checkout#2355\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6.0.1...v6.0.2\"\u003ehttps://github.com/actions/checkout/compare/v6.0.1...v6.0.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all references from v5 and v4 to v6 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2314\"\u003eactions/checkout#2314\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eClarify v6 README by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2328\"\u003eactions/checkout#2328\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1\"\u003e\u003ccode\u003e3d3c42e\u003c/code\u003e\u003c/a\u003e prep v7.0.1 release (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2531\"\u003e#2531\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07\"\u003e\u003ccode\u003e2880268\u003c/code\u003e\u003c/a\u003e escape values passed to --unset (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2530\"\u003e#2530\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1\"\u003e\u003ccode\u003e12cd223\u003c/code\u003e\u003c/a\u003e trim only ascii whitespace for branch (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2521\"\u003e#2521\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541\"\u003e\u003ccode\u003e62661c4\u003c/code\u003e\u003c/a\u003e skip running unsafe pr check if input is default (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2518\"\u003e#2518\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f\"\u003e\u003ccode\u003ee8d4307\u003c/code\u003e\u003c/a\u003e Bump the minor-actions-dependencies group with 2 updates (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2499\"\u003e#2499\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87\"\u003e\u003ccode\u003e631c942\u003c/code\u003e\u003c/a\u003e eslint 9 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2474\"\u003e#2474\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e\"\u003e\u003ccode\u003e4f1f4ae\u003c/code\u003e\u003c/a\u003e Bump actions/upload-artifact from 4 to 7 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2476\"\u003e#2476\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92\"\u003e\u003ccode\u003eba09753\u003c/code\u003e\u003c/a\u003e Bump actions/checkout from 6 to 7 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2488\"\u003e#2488\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22\"\u003e\u003ccode\u003eb9e0990\u003c/code\u003e\u003c/a\u003e Bump docker/login-action from 3.3.0 to 4.2.0 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2479\"\u003e#2479\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2\"\u003e\u003ccode\u003ee8cb398\u003c/code\u003e\u003c/a\u003e Bump docker/build-push-action from 6.5.0 to 7.2.0 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2478\"\u003e#2478\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/checkout/compare/v4...v7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `codecov/codecov-action` from 6 to 7\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/codecov/codecov-action/releases\"\u003ecodecov/codecov-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003cp\u003e⚠️ Due to migration issues with keybase, we are unable to update our keys under the \u003ccode\u003ecodecovsecurity\u003c/code\u003e account. We have deleted the account and are using \u003ccode\u003ecodecovsecops\u003c/code\u003e with the original gpg key\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eci: remove Enforce License Compliance workflow by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1950\"\u003ecodecov/codecov-action#1950\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(release): 7.0.0 by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1957\"\u003ecodecov/codecov-action#1957\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v6.0.1...v7.0.0\"\u003ehttps://github.com/codecov/codecov-action/compare/v6.0.1...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cp\u003eThis is a copy of the \u003ccode\u003ev7.0.0\u003c/code\u003e release to make updates easier\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eci: remove Enforce License Compliance workflow by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1950\"\u003ecodecov/codecov-action#1950\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(release): 7.0.0 by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1957\"\u003ecodecov/codecov-action#1957\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v6.0.1...v6.0.2\"\u003ehttps://github.com/codecov/codecov-action/compare/v6.0.1...v6.0.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: prevent template injection in run: steps (VULN-1652) by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1947\"\u003ecodecov/codecov-action#1947\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(release): 6.0.1 by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1949\"\u003ecodecov/codecov-action#1949\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1\"\u003ehttps://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md\"\u003ecodecov/codecov-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.5.2\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.1\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: overwrite pr number on fork by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1871\"\u003ecodecov/codecov-action#1871\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump actions/checkout from 4.2.2 to 5.0.0 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1868\"\u003ecodecov/codecov-action#1868\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1867\"\u003ecodecov/codecov-action#1867\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update to use local app/ dir by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1872\"\u003ecodecov/codecov-action#1872\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: fix typo in README by \u003ca href=\"https://github.com/datalater\"\u003e\u003ccode\u003e@​datalater\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1866\"\u003ecodecov/codecov-action#1866\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument a \u003ccode\u003ecodecov-cli\u003c/code\u003e version reference example by \u003ca href=\"https://github.com/webknjaz\"\u003e\u003ccode\u003e@​webknjaz\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1774\"\u003ecodecov/codecov-action#1774\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1861\"\u003ecodecov/codecov-action#1861\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1833\"\u003ecodecov/codecov-action#1833\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.0\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efeat: upgrade wrapper to 0.2.4 by \u003ca href=\"https://github.com/jviall\"\u003e\u003ccode\u003e@​jviall\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1864\"\u003ecodecov/codecov-action#1864\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin actions/github-script by Git SHA by \u003ca href=\"https://github.com/martincostello\"\u003e\u003ccode\u003e@​martincostello\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1859\"\u003ecodecov/codecov-action#1859\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: check reqs exist by \u003ca href=\"https://github.com/joseph-sentry\"\u003e\u003ccode\u003e@​joseph-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1835\"\u003ecodecov/codecov-action#1835\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: Typo in README by \u003ca href=\"https://github.com/spalmurray\"\u003e\u003ccode\u003e@​spalmurray\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1838\"\u003ecodecov/codecov-action#1838\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: Refine OIDC docs by \u003ca href=\"https://github.com/spalmurray\"\u003e\u003ccode\u003e@​spalmurray\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1837\"\u003ecodecov/codecov-action#1837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1829\"\u003ecodecov/codecov-action#1829\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.3\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1822\"\u003ecodecov/codecov-action#1822\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: OIDC on forks by \u003ca href=\"https://github.com/joseph-sentry\"\u003e\u003ccode\u003e@​joseph-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1823\"\u003ecodecov/codecov-action#1823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/codecov/codecov-action/compare/v6...v7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/init` from 4.35.2 to 4.37.9\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.37.9\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.8\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.37.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.6\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.3\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.37.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote=\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4007\"\u003e#4007\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\"\u003e2.26.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4019\"\u003e#4019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIn addition to the existing input format, the \u003ccode\u003econfig-file\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step will soon support a new \u003ccode\u003e[owner/]repo[@ref][:path]\u003c/code\u003e format. All components except the repository name are optional. If omitted, \u003ccode\u003eowner\u003c/code\u003e defaults to the same owner as the repository the analysis is running for, \u003ccode\u003eref\u003c/code\u003e to \u003ccode\u003emain\u003c/code\u003e, and \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003e.github/codeql-action.yaml\u003c/code\u003e. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3973\"\u003e#3973\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.36.3\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.36.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCache CodeQL CLI version information across Actions steps. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3943\"\u003e#3943\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3937\"\u003e#3937\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6\"\u003e2.25.6\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3948\"\u003e#3948\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.36.1\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.36.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.19.4. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.5 - 03 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.4 - 29 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.3 - 22 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.2 - 21 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote=\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4007\"\u003e#4007\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.1 - 16 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\"\u003e2.26.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4019\"\u003e#4019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.0 - 08 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/cdf488f595d80d6e07e03d4674febd5ab45fa938\"\u003e\u003ccode\u003ecdf488f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4107\"\u003e#4107\u003c/a\u003e from github/update-v4.37.9-920ba7cd1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7243f38558d187dde99730d224bb47aa26a95306\"\u003e\u003ccode\u003e7243f38\u003c/code\u003e\u003c/a\u003e Update changelog for v4.37.9\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/920ba7cd1596037e042122c00381eb16b397d68e\"\u003e\u003ccode\u003e920ba7c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4106\"\u003e#4106\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ecfa6e16817b8f490bc9a59baa391baf4fa3e3c2\"\u003e\u003ccode\u003eecfa6e1\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/adcdf4a70d247343cf9c29e0f7a6658b51c3a2b1\"\u003e\u003ccode\u003eadcdf4a\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/486fec2a3ea2626afcd8c7e9208b4f515078dd7e\"\u003e\u003ccode\u003e486fec2\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4099\"\u003e#4099\u003c/a\u003e from github/update-supported-enterprise-server-versions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/134624c67b20869c2aaa36dafa726375b78a5d76\"\u003e\u003ccode\u003e134624c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4101\"\u003e#4101\u003c/a\u003e from github/dependabot/npm_and_yarn/npm-minor-457d82...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ff43db8f982a368288f117354fb8d046e937124c\"\u003e\u003ccode\u003eff43db8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4103\"\u003e#4103\u003c/a\u003e from github/mergeback/v4.37.8-to-main-db488dde\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4605e03a74cf891614c4d76f82384a16c1c11816\"\u003e\u003ccode\u003e4605e03\u003c/code\u003e\u003c/a\u003e Rebuild\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/099c869cad6bf3b88657154d4ae47ffed27e632d\"\u003e\u003ccode\u003e099c869\u003c/code\u003e\u003c/a\u003e Update changelog and version after v4.37.8\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...cdf488f595d80d6e07e03d4674febd5ab45fa938\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.35.2 to 4.37.9\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.37.9\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.8\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.37.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.6\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.3\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.37.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote=\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4007\"\u003e#4007\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\"\u003e2.26.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4019\"\u003e#4019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIn addition to the existing input format, the \u003ccode\u003econfig-file\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step will soon support a new \u003ccode\u003e[owner/]repo[@ref][:path]\u003c/code\u003e format. All components except the repository name are optional. If omitted, \u003ccode\u003eowner\u003c/code\u003e defaults to the same owner as the repository the analysis is running for, \u003ccode\u003eref\u003c/code\u003e to \u003ccode\u003emain\u003c/code\u003e, and \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003e.github/codeql-action.yaml\u003c/code\u003e. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3973\"\u003e#3973\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.36.3\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.36.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCache CodeQL CLI version information across Actions steps. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3943\"\u003e#3943\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3937\"\u003e#3937\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6\"\u003e2.25.6\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3948\"\u003e#3948\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.36.1\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.36.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.19.4. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.5 - 03 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.4 - 29 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.3 - 22 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.2 - 21 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote=\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4007\"\u003e#4007\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.1 - 16 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\"\u003e2.26.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4019\"\u003e#4019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.0 - 08 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/cdf488f595d80d6e07e03d4674febd5ab45fa938\"\u003e\u003ccode\u003ecdf488f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4107\"\u003e#4107\u003c/a\u003e from github/update-v4.37.9-920ba7cd1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7243f38558d187dde99730d224bb47aa26a95306\"\u003e\u003ccode\u003e7243f38\u003c/code\u003e\u003c/a\u003e Update changelog for v4.37.9\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/920ba7cd1596037e042122c00381eb16b397d68e\"\u003e\u003ccode\u003e920ba7c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4106\"\u003e#4106\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ecfa6e16817b8f490bc9a59baa391baf4fa3e3c2\"\u003e\u003ccode\u003eecfa6e1\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/adcdf4a70d247343cf9c29e0f7a6658b51c3a2b1\"\u003e\u003ccode\u003eadcdf4a\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/486fec2a3ea2626afcd8c7e9208b4f515078dd7e\"\u003e\u003ccode\u003e486fec2\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4099\"\u003e#4099\u003c/a\u003e from github/update-supported-enterprise-server-versions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/134624c67b20869c2aaa36dafa726375b78a5d76\"\u003e\u003ccode\u003e134624c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4101\"\u003e#4101\u003c/a\u003e from github/dependabot/npm_and_yarn/npm-minor-457d82...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ff43db8f982a368288f117354fb8d046e937124c\"\u003e\u003ccode\u003eff43db8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4103\"\u003e#4103\u003c/a\u003e from github/mergeback/v4.37.8-to-main-db488dde\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4605e03a74cf891614c4d76f82384a16c1c11816\"\u003e\u003ccode\u003e4605e03\u003c/code\u003e\u003c/a\u003e Rebuild\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/099c869cad6bf3b88657154d4ae47ffed27e632d\"\u003e\u003ccode\u003e099c869\u003c/code\u003e\u003c/a\u003e Update changelog and version after v4.37.8\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...cdf488f595d80d6e07e03d4674febd5ab45fa938\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/github-script` from 7 to 9\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/github-script/releases\"\u003eactions/github-script's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev9.0.0\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eNew features:\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003egetOctokit\u003c/code\u003e factory function\u003c/strong\u003e — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See \u003ca href=\"https://github.com/actions/github-script#creating-additional-clients-with-getoctokit\"\u003eCreating additional clients with \u003ccode\u003egetOctokit\u003c/code\u003e\u003c/a\u003e for details and examples.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eOrchestration ID in user-agent\u003c/strong\u003e — The \u003ccode\u003eACTIONS_ORCHESTRATION_ID\u003c/code\u003e environment variable is automatically appended to the user-agent string for request tracing.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBreaking changes:\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003erequire('@actions/github')\u003c/code\u003e no longer works in scripts.\u003c/strong\u003e The upgrade to \u003ccode\u003e@actions/github\u003c/code\u003e v9 (ESM-only) means \u003ccode\u003erequire('@actions/github')\u003c/code\u003e will fail at runtime. If you previously used patterns like \u003ccode\u003econst { getOctokit } = require('@actions/github')\u003c/code\u003e to create secondary clients, use the new injected \u003ccode\u003egetOctokit\u003c/code\u003e function instead — it's available directly in the script context with no imports needed.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003egetOctokit\u003c/code\u003e is now an injected function parameter. Scripts that declare \u003ccode\u003econst getOctokit = ...\u003c/code\u003e or \u003ccode\u003elet getOctokit = ...\u003c/code\u003e will get a \u003ccode\u003eSyntaxError\u003c/code\u003e because JavaScript does not allow \u003ccode\u003econst\u003c/code\u003e/\u003ccode\u003elet\u003c/code\u003e redeclaration of function parameters. Use the injected \u003ccode\u003egetOctokit\u003c/code\u003e directly, or use \u003ccode\u003evar getOctokit = ...\u003c/code\u003e if you need to redeclare it.\u003c/li\u003e\n\u003cli\u003eIf your script accesses other \u003ccode\u003e@actions/github\u003c/code\u003e internals beyond the standard \u003ccode\u003egithub\u003c/code\u003e/\u003ccode\u003eoctokit\u003c/code\u003e client, you may need to update those references for v9 compatibility.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd ACTIONS_ORCHESTRATION_ID to user-agent string by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/695\"\u003eactions/github-script#695\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci: use deployment: false for integration test environments by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/712\"\u003eactions/github-script#712\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat!: add getOctokit to script context, upgrade \u003ccode\u003e@​actions/github\u003c/code\u003e v9, \u003ccode\u003e@​octokit/core\u003c/code\u003e v7, and related packages by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/700\"\u003eactions/github-script#700\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/695\"\u003eactions/github-script#695\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/github-script/compare/v8.0.0...v9.0.0\"\u003ehttps://github.com/actions/github-script/compare/v8.0.0...v9.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev8.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Node.js version support to 24.x by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/637\"\u003eactions/github-script#637\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eREADME for updating actions/github-script from v7 to v8 by \u003ca href=\"https://github.com/sneha-krip\"\u003e\u003ccode\u003e@​sneha-krip\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/653\"\u003eactions/github-script#653\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e⚠️ Minimum Compatible Runner Version\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003ev2.327.1\u003c/strong\u003e\u003cbr /\u003e\n\u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003eRelease Notes\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eMake sure your runner is updated to this version or newer to use this release.\u003c/p\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/637\"\u003eactions/github-script#637\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sneha-krip\"\u003e\u003ccode\u003e@​sneha-krip\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/653\"\u003eactions/github-script#653\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/github-script/compare/v7.1.0...v8.0.0\"\u003ehttps://github.com/actions/github-script/compare/v7.1.0...v8.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev7.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade husky to v9 by \u003ca href=\"https://github.com/benelan\"\u003e\u003ccode\u003e@​benelan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/482\"\u003eactions/github-script#482\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd workflow file for publishing releases to immutable action package by \u003ca href=\"https://github.com/Jcambass\"\u003e\u003ccode\u003e@​Jcambass\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/485\"\u003eactions/github-script#485\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade IA Publish by \u003ca href=\"https://github.com/Jcambass\"\u003e\u003ccode\u003e@​Jcambass\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/486\"\u003eactions/github-script#486\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix workflow status badges by \u003ca href=\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/497\"\u003eactions/github-script#497\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate usage of \u003ccode\u003eactions/upload-artifact\u003c/code\u003e by \u003ca href=\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/512\"\u003eactions/github-script#512\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eClear up package name confusion by \u003ca href=\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/514\"\u003eactions/github-script#514\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependencies with \u003ccode\u003enpm audit fix\u003c/code\u003e by \u003ca href=\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/515\"\u003eactions/github-script#515\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSpecify that the used script is JavaScript by \u003ca href=\"https://github.com/timotk\"\u003e\u003ccode\u003e@​timotk\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/478\"\u003eactions/github-script#478\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: Add Dependabot for NPM and Actions by \u003ca href=\"https://github.com/nschonni\"\u003e\u003ccode\u003e@​nschonni\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/472\"\u003eactions/github-script#472\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/github-script/commit/3a2844b7e9c422d3c10d287c895573f7108da1b3\"\u003e\u003ccode\u003e3a2844b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/github-script/issues/700\"\u003e#700\u003c/a\u003e from actions/salmanmkc/expose-getoctokit + prepare re...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/github-script/commit/ca10bbdd1a7739de09e99a200c7a59f5d73a4079\"\u003e\u003ccode\u003eca10bbd\u003c/code\u003e\u003c/a\u003e fix: use \u003ccode\u003e@​octokit/core/\u003c/code\u003etypes import for v7 compatibility\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/github-script/commit/86e48e20ac85c970ed1f96e718fd068173948b7b\"\u003e\u003ccode\u003e86e48e2\u003c/code\u003e\u003c/a\u003e merge: incorporate main branch changes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/github-script/commit/c1084728b5b935ec4ddc1e4cee877b01797b3ff9\"\u003e\u003ccode\u003ec108472\u003c/code\u003e\u003c/a\u003e chore: rebuild dist for v9 upgrade and getOctokit factory\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/github-script/commit/afff112e4f8b57c718168af75b89ce00bc8d091d\"\u003e\u003ccode\u003eafff112\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/github-script/issues/712\"\u003e#712\u003c/a\u003e from actions/salmanmkc/deployment-false + fix user-ag...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/github-script/commit/ff8117e5b78c415f814f39ad6998f424fee7b817\"\u003e\u003ccode\u003eff8117e\u003c/code\u003e\u003c/a\u003e ci: fix user-agent test to handle orchestration ID\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/github-script/commit/81c6b7876079abe10ff715951c9fc7b3e1ab389d\"\u003e\u003ccode\u003e81c6b78\u003c/code\u003e\u003c/a\u003e ci: use deployment: false to suppress deployment noise from integration tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/github-script/commit/3953caf8858d318f37b6cc53a9f5708859b5a7b7\"\u003e\u003ccode\u003e3953caf\u003c/code\u003e\u003c/a\u003e docs: update README examples from \u003ca href=\"https://github.com/v8\"\u003e\u003ccode\u003e@​v8\u003c/code\u003e\u003c/a\u003e to \u003ca href=\"https://github.com/v9\"\u003e\u003ccode\u003e@​v9\u003c/code\u003e\u003c/a\u003e, add getOctokit docs and v9 brea...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/github-script/commit/c17d55b90dcdb3d554d0027a6c180a7adc2daf78\"\u003e\u003ccode\u003ec17d55b\u003c/code\u003e\u003c/a\u003e ci: add getOctokit integration test job\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/github-script/commit/a047196d9a02fe92098771cafbb98c2f1814e408\"\u003e\u003ccode\u003ea047196\u003c/code\u003e\u003c/a\u003e test: add getOctokit integration tests via callAsyncFunction\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/github-script/compare/v7...v9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/setup-dotnet` from 5.3.0 to 6.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/setup-dotnet/releases\"\u003eactions/setup-dotnet's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate to ESM and upgrade dependencies by \u003ca href=\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/752\"\u003eactions/setup-dotnet#752\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 6.0.3 to 7.0.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/751\"\u003eactions/setup-dotnet#751\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 by \u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/756\"\u003eactions/setup-dotnet#756\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/756\"\u003eactions/setup-dotnet#756\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/setup-dotnet/compare/v5...v6.0.0\"\u003ehttps://github.com/actions/setup-dotnet/compare/v5...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePin actions to commit SHAs in workflows by \u003ca href=\"https://github.com/priya-kinthali\"\u003e\u003ccode\u003e@​priya-kinthali\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/744\"\u003eactions/setup-dotnet#744\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpand the CSC problem matcher to light up more errors on GitHub. by \u003ca href=\"https://github.com/StephenCleary\"\u003e\u003ccode\u003e@​StephenCleary\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/717\"\u003eactions/setup-dotnet#717\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImprove global.json SDK version validation for rollForward by \u003ca href=\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/742\"\u003eactions/setup-dotnet#742\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cblockquote\u003e\n\u003cp\u003eThe action now validates the \u003ccode\u003esdk.version\u003c/code\u003e field in \u003ccode\u003eglobal.json\u003c/code\u003e when \u003ccode\u003erollForward\u003c/code\u003e is specified. The version must be a fully-qualified SDK version (e.g., \u003ccode\u003e8.0.100\u003c/code\u003e, \u003ccode\u003e10.0.100\u003c/code\u003e). Wildcard versions (e.g., \u003ccode\u003e10.0.*\u003c/code\u003e) and runtime-style versions (e.g., \u003ccode\u003e8.0.0\u003c/code\u003e) will now fail. See the \u003ca href=\"https://learn.microsoft.com/en-us/dotnet/core/tools/global-json#version\"\u003e.NET SDK version specification\u003c/a\u003e for details.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch3\u003eDocumentation\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDocs(action): Explicitly mark all optional inputs with required: false by \u003ca href=\"https://github.com/kranthipoturaju\"\u003e\u003ccode\u003e@​kranthipoturaju\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/737\"\u003eactions/setup-dotnet#737\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix global.json creation command by \u003ca href=\"https://github.com/michal2612\"\u003e\u003ccode\u003e@​michal2612\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/694\"\u003eactions/setup-dotnet#694\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency Updates\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​actions/cache\u003c/code\u003e to 5.1.0, log cache write denied by \u003ca href=\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/746\"\u003eactions/setup-dotnet#746\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/746\"\u003eactions/setup-dotnet#746\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/michal2612\"\u003e\u003ccode\u003e@​michal2612\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/694\"\u003eactions/setup-dotnet#694\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kranthipoturaju\"\u003e\u003ccode\u003e@​kranthipoturaju\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/737\"\u003eactions/setup-dotnet#737\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/StephenCleary\"\u003e\u003ccode\u003e@​StephenCleary\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/717\"\u003eactions/setup-dotnet#717\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/setup-dotnet/compare/v5.3.0...v5.4.0\"\u003ehttps://github.com/actions/setup-dotnet/compare/v5.3.0...v5.4.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-dotnet/commit/a98b56852c35b8e3190ac28c8c2271da59106c68\"\u003e\u003ccode\u003ea98b568\u003c/code\u003e\u003c/a\u003e chore(deps): bump \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 (\u003ca href=\"https://redirect.github.com/actions/setup-dotnet/issues/756\"\u003e#756\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-dotnet/commit/afb2931642fd907238eb71bce2da0dcc910b3553\"\u003e\u003ccode\u003eafb2931\u003c/code\u003e\u003c/a\u003e Bump actions/checkout from 6.0.3 to 7.0.0 (\u003ca href=\"https://redirect.github.com/actions/setup-dotnet/issues/751\"\u003e#751\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-dotnet/commit/6df8cefd1440cf9313e76b8fdb8aaf90cfa745a3\"\u003e\u003ccode\u003e6df8cef\u003c/code\u003e\u003c/a\u003e Migrate to ESM and upgrade dependencies (\u003ca href=\"https://redirect.github.com/actions/setup-dotnet/issues/752\"\u003e#752\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-dotnet/commit/26b0ec14cb23fa6904739307f278c14f94c95bf1\"\u003e\u003ccode\u003e26b0ec1\u003c/code\u003e\u003c/a\u003e Expand the CSC problem matcher to light up more errors on GitHub. (\u003ca href=\"https://redirect.github.com/actions/setup-dotnet/issues/717\"\u003e#717\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-dotnet/commit/da5e5482f2d0700168cff080da45b50da8b60f0e\"\u003e\u003ccode\u003eda5e548\u003c/code\u003e\u003c/a\u003e docs(action): explicitly mark all optional inputs with required: false (\u003ca href=\"https://redirect.github.com/actions/setup-dotnet/issues/737\"\u003e#737\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-dotnet/commit/9bd3b44355ba7c500f3d2e029636c6d29ac5caab\"\u003e\u003ccode\u003e9bd3b44\u003c/code\u003e\u003c/a\u003e Improve readability of global.json creation command (\u003ca href=\"https://redirect.github.com/actions/setup-dotnet/issues/694\"\u003e#694\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-dotnet/commit/4406a635cd2be9c92689ea22b2f74ea57297088c\"\u003e\u003ccode\u003e4406a63\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/cache\u003c/code\u003e to 5.1.0, log cache write denied (\u003ca href=\"https://redirect.github.com/actions/setup-dotnet/issues/746\"\u003e#746\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-dotnet/commit/dc3262dda80e97f1c7865b3b122e99240e30b738\"\u003e\u003ccode\u003edc3262d\u003c/code\u003e\u003c/a\u003e pin actions to commit SHAs in workflows (\u003ca href=\"https://redirect.github.com/actions/setup-dotnet/issues/744\"\u003e#744\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-dotnet/commit/95a3f8b067437dc9b2027a437f5dc3b4569ddd49\"\u003e\u003ccode\u003e95a3f8b\u003c/code\u003e\u003c/a\u003e Validate global.json SDK version before rollForward optimization (\u003ca href=\"https://redirect.github.com/actions/setup-dotnet/issues/742\"\u003e#742\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/setup-dotnet/compare/9a946fdbd5fb07b82b2f5a4466058b876ab72bb2...a98b56852c35b8e3190ac28c8c2271da59106c68\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.35.2 to 4.37.9\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.37.9\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.8\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.37.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.6\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egith...\n\n_Description has been truncated_\n\n\u003c!-- This is an auto-generated description by cubic. --\u003e\n---\n## Summary by cubic\nUpdates 13 GitHub Actions across 21 workflow files to their latest versions, keeping CI tooling current.\n\n**Breaking changes**\n- `actions/checkout` v7 blocks checkout of fork PRs for `pull_request_target` and `workflow_run` triggers unless `allow-unsafe-pr-checkout` is set.\n- `actions/github-script` v9 is ESM-only and no longer supports `require('@actions/github')`; scripts using it must switch to the injected `getOctokit` function.\n- `actions/setup-dotnet` v5.4+ now rejects wildcard or runtime-style versions in `global.json` when `rollForward` is set; v6 adds ESM migration and runner requirement v2.327.1+.\n- `actions/setup-java` v6 and `actions/labeler` v7 require runner v2.327.1+ and may change label matching behavior.\n\n\u003csup\u003eWritten for commit ac7b8dbbcd487c234c3374d7b3e7d41ba6abe734. Summary will update on new commits.\u003c/sup\u003e\n\n\u003ca href=\"https://cubic.dev/pr/antigravityos187-sketch/universal-or-strategy/pull/33?utm_source=github\" target=\"_blank\" rel=\"noopener noreferrer\" data-no-image-dialog=\"true\"\u003e\u003cpicture\u003e\u003csource media=\"(prefers-color-scheme: dark)\" srcset=\"https://www.cubic.dev/buttons/review-in-cubic-dark.svg\"\u003e\u003csource media=\"(prefers-color-scheme: light)\" srcset=\"https://www.cubic.dev/buttons/review-in-cubic-light.svg\"\u003e\u003cimg alt=\"Review in cubic\" src=\"https://www.cubic.dev/buttons/review-in-cubic-dark.svg\"\u003e\u003c/picture\u003e\u003c/a\u003e\n\n\u003c!-- End of auto-generated description by cubic. --\u003e","html_url":"https://github.com/antigravityos187-sketch/universal-or-strategy/pull/33","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/antigravityos187-sketch%2Funiversal-or-strategy/issues/33","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/33/packages"},{"uuid":"5246469642","node_id":"PR_kwDOQCFGY88AAAABA8Ux6A","number":81,"state":"closed","title":"Bump google/osv-scanner-action from 2.3.8 to 2.5.1","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-09-04T08:45:02.000Z","author_association":null,"state_reason":null,"created_at":"2026-08-25T13:33:36.000Z","updated_at":"2026-09-04T08:45:10.000Z","time_to_close":846686,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"google/osv-scanner-action","old_version":"2.3.8","new_version":"2.5.1","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [google/osv-scanner-action](https://github.com/google/osv-scanner-action) from 2.3.8 to 2.5.1.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.1\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions/checkout action to v7 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/133\"\u003egoogle/osv-scanner-action#133\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve package namespaces when querying osv.dev API (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2978\"\u003e#2978\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eRe-add support for the \u003ccode\u003eOSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY\u003c/code\u003e environment variable (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2983\"\u003e#2983\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eFix local vulnerability matching (\u003ccode\u003e--offline-vulnerabilities\u003c/code\u003e) not working when network capability is \u003ccode\u003eNetworkOnline\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.5.0 as well as:\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: gate reusable workflow outputs with a flag by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/130\"\u003egoogle/osv-scanner-action#130\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin download-artifact action to SHA by \u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add runs-on input to reusable workflows by \u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: address zizmor warnings by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/135\"\u003egoogle/osv-scanner-action#135\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: add GOTOOLCHAIN=auto env to osv-scanner calls by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/138\"\u003egoogle/osv-scanner-action#138\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/6e4298ebc4db23e847df9b2e2de2939d6f066c67\"\u003e\u003ccode\u003e6e4298e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/141\"\u003e#141\u003c/a\u003e from google/update-to-v2.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/5957b4e7a8725730a37d973099c16b9fe44cfc5f\"\u003e\u003ccode\u003e5957b4e\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.1 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/880d9b542cc66d36d91d51b3fbcc038f5f28cfc5\"\u003e\u003ccode\u003e880d9b5\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.1 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/baa4139e56d6312335d899e6ba045fa16d1d3d0b\"\u003e\u003ccode\u003ebaa4139\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.5.1 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f4cfcc01edc9c8b756a9b873b7a623ca674da51e\"\u003e\u003ccode\u003ef4cfcc0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/117\"\u003e#117\u003c/a\u003e from renovate-bot/renovate/workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dfd4cd1d0114e5fc71a6862faf1114ed69d9dca7\"\u003e\u003ccode\u003edfd4cd1\u003c/code\u003e\u003c/a\u003e Update workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/e13f842f8f0b5845b610f16e8a2eb7f22a7f8677\"\u003e\u003ccode\u003ee13f842\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/133\"\u003e#133\u003c/a\u003e from renovate-bot/renovate/major-workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8deb546fdb875b9996d27d4950be7312dac076a1\"\u003e\u003ccode\u003e8deb546\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/140\"\u003e#140\u003c/a\u003e from google/update-to-v2.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8fb3f8c89519ea2c868d3277441ee7fd3c7f15af\"\u003e\u003ccode\u003e8fb3f8c\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.0 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/0c58c542420dfd23fcac08dd9c8ca3cca9c36f1a\"\u003e\u003ccode\u003e0c58c54\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.0 actions\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google/osv-scanner-action\u0026package-manager=github_actions\u0026previous-version=2.3.8\u0026new-version=2.5.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/andreibesleaga/camara-emergency-demo/pull/81","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/andreibesleaga%2Fcamara-emergency-demo/issues/81","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/81/packages"},{"uuid":"5117211691","node_id":"PR_kwDOPJG7H879W8OL","number":47,"state":"closed","title":"chore(deps): bump the actions group with 2 updates","user":"dependabot[bot]","labels":["dependencies"],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":"2026-08-13T14:07:06.000Z","author_association":null,"state_reason":null,"created_at":"2026-08-11T06:08:44.000Z","updated_at":"2026-08-13T14:07:08.000Z","time_to_close":201502,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"actions","update_count":2,"packages":[{"name":"pnpm/action-setup","old_version":"6.0.9","new_version":"6.0.10","repository_url":"https://github.com/pnpm/action-setup"},{"name":"google/osv-scanner-action","old_version":"2.3.8","new_version":"2.5.0","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"[//]: # (dependabot-start)\n⚠️  **Dependabot is rebasing this PR** ⚠️ \n\nRebasing might not happen immediately, so don't worry if this takes some time.\n\nNote: if you make any changes to this PR yourself, they will take precedence over the rebase.\n\n---\n\n[//]: # (dependabot-end)\n\nBumps the actions group with 2 updates: [pnpm/action-setup](https://github.com/pnpm/action-setup) and [google/osv-scanner-action](https://github.com/google/osv-scanner-action).\n\nUpdates `pnpm/action-setup` from 6.0.9 to 6.0.10\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pnpm/action-setup/releases\"\u003epnpm/action-setup's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.10\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs(README): point users to the successor pnpm/setup action by \u003ca href=\"https://github.com/BlackHole1\"\u003e\u003ccode\u003e@​BlackHole1\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pnpm/action-setup/pull/282\"\u003epnpm/action-setup#282\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erefactor: introduce restore keys for cache by \u003ca href=\"https://github.com/SukkaW\"\u003e\u003ccode\u003e@​SukkaW\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pnpm/action-setup/pull/280\"\u003epnpm/action-setup#280\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci: use pnpm 11 for \u003ccode\u003epr-check\u003c/code\u003e by \u003ca href=\"https://github.com/jamietanna\"\u003e\u003ccode\u003e@​jamietanna\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pnpm/action-setup/pull/284\"\u003epnpm/action-setup#284\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update pnpm to v11.19.0 by \u003ca href=\"https://github.com/jamietanna\"\u003e\u003ccode\u003e@​jamietanna\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pnpm/action-setup/pull/283\"\u003epnpm/action-setup#283\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: update README to include devEngines.packageManager by \u003ca href=\"https://github.com/nemchik\"\u003e\u003ccode\u003e@​nemchik\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pnpm/action-setup/pull/273\"\u003epnpm/action-setup#273\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jamietanna\"\u003e\u003ccode\u003e@​jamietanna\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/pnpm/action-setup/pull/284\"\u003epnpm/action-setup#284\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nemchik\"\u003e\u003ccode\u003e@​nemchik\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/pnpm/action-setup/pull/273\"\u003epnpm/action-setup#273\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/pnpm/action-setup/compare/v6...v6.0.10\"\u003ehttps://github.com/pnpm/action-setup/compare/v6...v6.0.10\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pnpm/action-setup/commit/0977fd99725f1db4007ccb2928dbb4e90d06cc86\"\u003e\u003ccode\u003e0977fd9\u003c/code\u003e\u003c/a\u003e docs: Update README to include devEngines.packageManager (\u003ca href=\"https://redirect.github.com/pnpm/action-setup/issues/273\"\u003e#273\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pnpm/action-setup/commit/48261aca053e825d84804e8ce05524d558249ac9\"\u003e\u003ccode\u003e48261ac\u003c/code\u003e\u003c/a\u003e fix: update pnpm to v11.19.0 (\u003ca href=\"https://redirect.github.com/pnpm/action-setup/issues/283\"\u003e#283\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pnpm/action-setup/commit/75677f717d48404e86ae8ee4891543f40de175aa\"\u003e\u003ccode\u003e75677f7\u003c/code\u003e\u003c/a\u003e ci: use pnpm 11 for \u003ccode\u003epr-check\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/pnpm/action-setup/issues/284\"\u003e#284\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pnpm/action-setup/commit/769ae71fb33e6e448a5dc92ad5da997c268eecec\"\u003e\u003ccode\u003e769ae71\u003c/code\u003e\u003c/a\u003e refactor: introduce restore keys for cache (\u003ca href=\"https://redirect.github.com/pnpm/action-setup/issues/280\"\u003e#280\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pnpm/action-setup/commit/6fed91f804570c1144bfe1911c348642cb986bd4\"\u003e\u003ccode\u003e6fed91f\u003c/code\u003e\u003c/a\u003e docs(README): point users to the successor pnpm/setup action (\u003ca href=\"https://redirect.github.com/pnpm/action-setup/issues/282\"\u003e#282\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/pnpm/action-setup/compare/v6.0.9...v6.0.10\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action` from 2.3.8 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.5.0 as well as:\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: gate reusable workflow outputs with a flag by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/130\"\u003egoogle/osv-scanner-action#130\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin download-artifact action to SHA by \u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add runs-on input to reusable workflows by \u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: address zizmor warnings by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/135\"\u003egoogle/osv-scanner-action#135\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: add GOTOOLCHAIN=auto env to osv-scanner calls by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/138\"\u003egoogle/osv-scanner-action#138\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8deb546fdb875b9996d27d4950be7312dac076a1\"\u003e\u003ccode\u003e8deb546\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/140\"\u003e#140\u003c/a\u003e from google/update-to-v2.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8fb3f8c89519ea2c868d3277441ee7fd3c7f15af\"\u003e\u003ccode\u003e8fb3f8c\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.0 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/0c58c542420dfd23fcac08dd9c8ca3cca9c36f1a\"\u003e\u003ccode\u003e0c58c54\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.0 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/06b2ab4348248b456ee06c9e953637f55e03504f\"\u003e\u003ccode\u003e06b2ab4\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.5.0 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9fd1bcce27f67e3bd819a0a7620e332803dc43bc\"\u003e\u003ccode\u003e9fd1bcc\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/138\"\u003e#138\u003c/a\u003e from google/fix/gotoolchain-auto\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/01a87d56220b68b35ceebc4a7a3f3de666173da6\"\u003e\u003ccode\u003e01a87d5\u003c/code\u003e\u003c/a\u003e fix: add GOTOOLCHAIN=auto env to osv-scanner calls\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/a82132c0bd6c7261ffcb78e754c46c70ab57ad9a\"\u003e\u003ccode\u003ea82132c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/135\"\u003e#135\u003c/a\u003e from google/fix-zizmor-excessive-permissions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/272ff57b30ae5bef2488ba122ab6852c0d735a2d\"\u003e\u003ccode\u003e272ff57\u003c/code\u003e\u003c/a\u003e fix: address zizmor template injection warnings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/10621fba4fb802e4fbe82d664deb6d5c44d233d5\"\u003e\u003ccode\u003e10621fb\u003c/code\u003e\u003c/a\u003e refactor: move permissions to job level to satisfy zizmor\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fa4ff678dd5d0a4fa3d628e57af8162873e93cd6\"\u003e\u003ccode\u003efa4ff67\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/131\"\u003e#131\u003c/a\u003e from BeyondEvil/feat/add-runs-on-input\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/NaturalDevCR/atemporal/pull/47","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/NaturalDevCR%2Fatemporal/issues/47","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/47/packages"},{"uuid":"4568724114","node_id":"PR_kwDOPvOdvs7hpgTe","number":288,"state":"open","title":"ci: bump the github-actions group with 2 updates","user":"dependabot[bot]","labels":["dependencies"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-02T05:31:52.000Z","updated_at":"2026-06-02T05:31:53.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci: bump","group_name":"github-actions","update_count":2,"packages":[{"name":"google/osv-scanner-action","old_version":"2.2.3","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"gitleaks/gitleaks-action","old_version":"2","new_version":"3","repository_url":"https://github.com/gitleaks/gitleaks-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions group with 2 updates: [google/osv-scanner-action](https://github.com/google/osv-scanner-action) and [gitleaks/gitleaks-action](https://github.com/gitleaks/gitleaks-action).\n\nUpdates `google/osv-scanner-action` from 2.2.3 to 2.3.8\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.5\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.5.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to v2.3.5 by \u003ca href=\"https://github.com/tobyhawker\"\u003e\u003ccode\u003e@​tobyhawker\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/124\"\u003egoogle/osv-scanner-action#124\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tobyhawker\"\u003e\u003ccode\u003e@​tobyhawker\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/124\"\u003egoogle/osv-scanner-action#124\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.3...v2.3.5\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.3...v2.3.5\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.3\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.3.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): update github/codeql-action action to v4.31.10 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/115\"\u003egoogle/osv-scanner-action#115\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate to v2.3.3 by \u003ca href=\"https://github.com/Ly-Joey\"\u003e\u003ccode\u003e@​Ly-Joey\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/118\"\u003egoogle/osv-scanner-action#118\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Ly-Joey\"\u003e\u003ccode\u003e@​Ly-Joey\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/118\"\u003egoogle/osv-scanner-action#118\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.2...v2.3.3\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.2...v2.3.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.2\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.2\u003c/p\u003e\n\u003cp\u003eThis release includes performance improvements for local scanning, reducing memory usage and avoiding unnecessary advisory loading. It also fixes issues with MCP's get_vulnerability_details tool, git queries in \u003ccode\u003eosv-scanner.json\u003c/code\u003e, and ignore entry tracking, along with documentation updates.\u003c/p\u003e\n\u003ch3\u003eFixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2415\"\u003e#2415\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2415\"\u003egoogle/osv-scanner#2415\u003c/a\u003e) Add more PURL-to-ecosystem mappings\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2422\"\u003e#2422\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2422\"\u003egoogle/osv-scanner#2422\u003c/a\u003e) MCP error for get_vulnerability_id because type definition is incorrect.\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2460\"\u003e#2460\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2460\"\u003egoogle/osv-scanner#2460\u003c/a\u003e) Enable osv-scanner.json git queries\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2456\"\u003e#2456\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2456\"\u003egoogle/osv-scanner#2456\u003c/a\u003e) Properly track if an ignore entry has been used\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2450\"\u003e#2450\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2450\"\u003egoogle/osv-scanner#2450\u003c/a\u003e) \u003cstrong\u003ePerformance:\u003c/strong\u003e Avoid loading the entire advisory unless it will actually be used\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2445\"\u003e#2445\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2445\"\u003egoogle/osv-scanner#2445\u003c/a\u003e) \u003cstrong\u003ePerformance:\u003c/strong\u003e Don't read the entire zip into memory\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2433\"\u003e#2433\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2433\"\u003egoogle/osv-scanner#2433\u003c/a\u003e) Allow specifying user agent in v2 osvscanner package\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMisc:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e[Misc \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2453\"\u003e#2453\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2453\"\u003egoogle/osv-scanner#2453\u003c/a\u003e) Switch from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3\u003c/li\u003e\n\u003cli\u003e[Misc \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2447\"\u003e#2447\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2447\"\u003egoogle/osv-scanner#2447\u003c/a\u003e) Include \u003ccode\u003ebun.lock\u003c/code\u003e as a supported lockfile\u003c/li\u003e\n\u003cli\u003e[Misc \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2444\"\u003e#2444\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2444\"\u003egoogle/osv-scanner#2444\u003c/a\u003e) Document GoVersionOverride in configuration.md\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9517144e5504957104c831530fe605bfdc71f353\"\u003e\u003ccode\u003e9517144\u003c/code\u003e\u003c/a\u003e feat: output results in reusable workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f17cd09224d6ef8be953fb49371e6bffb2dbf44a\"\u003e\u003ccode\u003ef17cd09\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into main\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.2.3...v2.3.8\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `gitleaks/gitleaks-action` from 2 to 3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/gitleaks/gitleaks-action/releases\"\u003egitleaks/gitleaks-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's changed\u003c/h2\u003e\n\u003cp\u003egitleaks-action v3 migrates the runtime from Node 20 to Node 24. \u003cstrong\u003eNo changes to inputs, outputs, or behavior.\u003c/strong\u003e Update your workflow from \u003ccode\u003egitleaks/gitleaks-action@v2\u003c/code\u003e to \u003ccode\u003egitleaks/gitleaks-action@v3\u003c/code\u003e.\u003c/p\u003e\n\u003ch3\u003eMigration\u003c/h3\u003e\n\u003cpre lang=\"yaml\"\u003e\u003ccode\u003e# Before\n- uses: gitleaks/gitleaks-action@v2\n\u003ch1\u003eAfter\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003euses: gitleaks/gitleaks-action@v3\u003cbr /\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eWhy\u003c/h3\u003e\n\u003cp\u003eGitHub is deprecating the Node 20 runtime for Actions:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eJune 2, 2026:\u003c/strong\u003e GitHub flips the runner default to Node 24. Workflows using \u003ccode\u003egitleaks-action@v2\u003c/code\u003e (Node 20) will still run, but only if \u003ccode\u003eACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true\u003c/code\u003e is set as an environment variable.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eSeptember 16, 2026:\u003c/strong\u003e Node 20 is removed from GitHub-hosted runners entirely. \u003ccode\u003egitleaks-action@v2\u003c/code\u003e stops working regardless of any opt-out flag.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eaction.yml\u003c/code\u003e: runtime \u003ccode\u003enode20\u003c/code\u003e → \u003ccode\u003enode24\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e@actions/core\u003c/code\u003e: 1.10.0 → 1.11.1\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003edist/\u003c/code\u003e rebuilt\u003c/li\u003e\n\u003cli\u003eExample workflows updated to \u003ccode\u003eactions/checkout@v6\u003c/code\u003e and \u003ccode\u003egitleaks-action@v3\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eREADME updated with v3 migration guide\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eSelf-hosted runners\u003c/h3\u003e\n\u003cp\u003eIf you use self-hosted runners, ensure your runner version is \u003ccode\u003e\u0026gt;= v2.327.1\u003c/code\u003e (required for Node 24 support).\u003c/p\u003e\n\u003ch2\u003ev2.3.9\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebump cache by \u003ca href=\"https://github.com/zricethezav\"\u003e\u003ccode\u003e@​zricethezav\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitleaks/gitleaks-action/pull/181\"\u003egitleaks/gitleaks-action#181\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/gitleaks/gitleaks-action/compare/v2.3.8...v2.3.9\"\u003ehttps://github.com/gitleaks/gitleaks-action/compare/v2.3.8...v2.3.9\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd environment variable to override gitleaks baseRef by \u003ca href=\"https://github.com/paulschuberth\"\u003e\u003ccode\u003e@​paulschuberth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitleaks/gitleaks-action/pull/113\"\u003egitleaks/gitleaks-action#113\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebump default gitleaks version, update license filename, fix vulns by \u003ca href=\"https://github.com/zricethezav\"\u003e\u003ccode\u003e@​zricethezav\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitleaks/gitleaks-action/pull/178\"\u003egitleaks/gitleaks-action#178\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/paulschuberth\"\u003e\u003ccode\u003e@​paulschuberth\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/gitleaks/gitleaks-action/pull/113\"\u003egitleaks/gitleaks-action#113\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/gitleaks/gitleaks-action/compare/v2.3.7...v2.3.8\"\u003ehttps://github.com/gitleaks/gitleaks-action/compare/v2.3.7...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitleaks/gitleaks-action/commit/e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e\"\u003e\u003ccode\u003ee0c47f4\u003c/code\u003e\u003c/a\u003e chore: migrate to Node 24 runtime (v3)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitleaks/gitleaks-action/commit/bf2dc8e55639c1e091e9b45970152e4313705814\"\u003e\u003ccode\u003ebf2dc8e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/gitleaks/gitleaks-action/issues/191\"\u003e#191\u003c/a\u003e from Olexandr88/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitleaks/gitleaks-action/commit/b71323b056f4cc8c7f4cc7decfcc26b5e80b8e15\"\u003e\u003ccode\u003eb71323b\u003c/code\u003e\u003c/a\u003e Update README.md\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitleaks/gitleaks-action/commit/9c66aa96d2700e2b6aa0f9f7021ae6e5cc7a4375\"\u003e\u003ccode\u003e9c66aa9\u003c/code\u003e\u003c/a\u003e Update README.md\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitleaks/gitleaks-action/commit/186c3fea8923e06a92dc3806067ad6afaf53e754\"\u003e\u003ccode\u003e186c3fe\u003c/code\u003e\u003c/a\u003e Create FUNDING.yml\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/gitleaks/gitleaks-action/compare/v2...v3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/po4yka/ratatoskr/pull/288","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/po4yka%2Fratatoskr/issues/288","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/288/packages"},{"uuid":"4559938710","node_id":"PR_kwDOQTCNSM7hM2rS","number":65,"state":"open","title":"ci: bump google/osv-scanner-action from 2.3.5 to 2.3.8","user":"dependabot[bot]","labels":["dependencies"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-01T02:43:31.000Z","updated_at":"2026-06-01T02:44:28.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci","packages":[{"name":"google/osv-scanner-action","old_version":"2.3.5","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [google/osv-scanner-action](https://github.com/google/osv-scanner-action) from 2.3.5 to 2.3.8.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9517144e5504957104c831530fe605bfdc71f353\"\u003e\u003ccode\u003e9517144\u003c/code\u003e\u003c/a\u003e feat: output results in reusable workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f17cd09224d6ef8be953fb49371e6bffb2dbf44a\"\u003e\u003ccode\u003ef17cd09\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into main\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google/osv-scanner-action\u0026package-manager=github_actions\u0026previous-version=2.3.5\u0026new-version=2.3.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/antonio59/ProtectMyMobile/pull/65","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/antonio59%2FProtectMyMobile/issues/65","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/65/packages"},{"uuid":"4555447739","node_id":"PR_kwDOSsdUbs7g_cEb","number":4,"state":"closed","title":"ci: bump the actions group across 1 directory with 9 updates","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":5,"pull_request":true,"closed_at":"2026-05-31T01:16:58.000Z","author_association":null,"state_reason":null,"created_at":"2026-05-30T19:29:21.000Z","updated_at":"2026-05-31T01:17:07.000Z","time_to_close":20857,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci: bump","group_name":"actions","update_count":9,"packages":[{"name":"actions/checkout","old_version":"4","new_version":"6","repository_url":"https://github.com/actions/checkout"},{"name":"jdx/mise-action","old_version":"2","new_version":"4","repository_url":"https://github.com/jdx/mise-action"},{"name":"actions/upload-artifact","old_version":"4","new_version":"7","repository_url":"https://github.com/actions/upload-artifact"},{"name":"DavidAnson/markdownlint-cli2-action","old_version":"17","new_version":"23","repository_url":"https://github.com/davidanson/markdownlint-cli2-action"},{"name":"docker/setup-buildx-action","old_version":"3","new_version":"4","repository_url":"https://github.com/docker/setup-buildx-action"},{"name":"docker/bake-action","old_version":"6","new_version":"7","repository_url":"https://github.com/docker/bake-action"},{"name":"google/osv-scanner-action","old_version":"2.2.4","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"github/codeql-action","old_version":"3","new_version":"4","repository_url":"https://github.com/github/codeql-action"},{"name":"ossf/scorecard-action","old_version":"2.4.2","new_version":"2.4.3","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the actions group with 9 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/checkout](https://github.com/actions/checkout) | `4` | `6` |\n| [jdx/mise-action](https://github.com/jdx/mise-action) | `2` | `4` |\n| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` |\n| [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action) | `17` | `23` |\n| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3` | `4` |\n| [docker/bake-action](https://github.com/docker/bake-action) | `6` | `7` |\n| [google/osv-scanner-action](https://github.com/google/osv-scanner-action) | `2.2.4` | `2.3.8` |\n| [github/codeql-action](https://github.com/github/codeql-action) | `3` | `4` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.2` | `2.4.3` |\n\n\nUpdates `actions/checkout` from 4 to 6\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/releases\"\u003eactions/checkout's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ev6-beta by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2298\"\u003eactions/checkout#2298\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate readme/changelog for v6 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2311\"\u003eactions/checkout#2311\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v5.0.0...v6.0.0\"\u003ehttps://github.com/actions/checkout/compare/v5.0.0...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6-beta\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eUpdated persist-credentials to store the credentials under \u003ccode\u003e$RUNNER_TEMP\u003c/code\u003e instead of directly in the local git config.\u003c/p\u003e\n\u003cp\u003eThis requires a minimum Actions Runner version of \u003ca href=\"https://github.com/actions/runner/releases/tag/v2.329.0\"\u003ev2.329.0\u003c/a\u003e to access the persisted credentials for \u003ca href=\"https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action\"\u003eDocker container action\u003c/a\u003e scenarios.\u003c/p\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v5...v5.0.1\"\u003ehttps://github.com/actions/checkout/compare/v5...v5.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare v5.0.0 release by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2238\"\u003eactions/checkout#2238\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e⚠️ Minimum Compatible Runner Version\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003ev2.327.1\u003c/strong\u003e\u003cbr /\u003e\n\u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003eRelease Notes\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eMake sure your runner is updated to this version or newer to use this release.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v4...v5.0.0\"\u003ehttps://github.com/actions/checkout/compare/v4...v5.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.3.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v4 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2305\"\u003eactions/checkout#2305\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v4...v4.3.1\"\u003ehttps://github.com/actions/checkout/compare/v4...v4.3.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update README.md by \u003ca href=\"https://github.com/motss\"\u003e\u003ccode\u003e@​motss\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1971\"\u003eactions/checkout#1971\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd internal repos for checking out multiple repositories by \u003ca href=\"https://github.com/mouismail\"\u003e\u003ccode\u003e@​mouismail\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1977\"\u003eactions/checkout#1977\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation update - add recommended permissions to Readme by \u003ca href=\"https://github.com/benwells\"\u003e\u003ccode\u003e@​benwells\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2043\"\u003eactions/checkout#2043\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/de0fac2e4500dabe0009e67214ff5f5447ce83dd\"\u003e\u003ccode\u003ede0fac2\u003c/code\u003e\u003c/a\u003e Fix tag handling: preserve annotations and explicit fetch-tags (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2356\"\u003e#2356\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/064fe7f3312418007dea2b49a19844a9ee378f49\"\u003e\u003ccode\u003e064fe7f\u003c/code\u003e\u003c/a\u003e Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/8e8c483db84b4bee98b60c0593521ed34d9990e8\"\u003e\u003ccode\u003e8e8c483\u003c/code\u003e\u003c/a\u003e Clarify v6 README (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2328\"\u003e#2328\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/033fa0dc0b82693d8986f1016a0ec2c5e7d9cbb1\"\u003e\u003ccode\u003e033fa0d\u003c/code\u003e\u003c/a\u003e Add worktree support for persist-credentials includeIf (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2327\"\u003e#2327\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5\"\u003e\u003ccode\u003ec2d88d3\u003c/code\u003e\u003c/a\u003e Update all references from v5 and v4 to v6 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2314\"\u003e#2314\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3\"\u003e\u003ccode\u003e1af3b93\u003c/code\u003e\u003c/a\u003e update readme/changelog for v6 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2311\"\u003e#2311\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/71cf2267d89c5cb81562390fa70a37fa40b1305e\"\u003e\u003ccode\u003e71cf226\u003c/code\u003e\u003c/a\u003e v6-beta (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2298\"\u003e#2298\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/069c6959146423d11cd0184e6accf28f9d45f06e\"\u003e\u003ccode\u003e069c695\u003c/code\u003e\u003c/a\u003e Persist creds to a separate file (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2286\"\u003e#2286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493\"\u003e\u003ccode\u003eff7abcd\u003c/code\u003e\u003c/a\u003e Update README to include Node.js 24 support details and requirements (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2248\"\u003e#2248\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/08c6903cd8c0fde910a37f88322edcfb5dd907a8\"\u003e\u003ccode\u003e08c6903\u003c/code\u003e\u003c/a\u003e Prepare v5.0.0 release (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2238\"\u003e#2238\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/checkout/compare/v4...v6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `jdx/mise-action` from 2 to 4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jdx/mise-action/releases\"\u003ejdx/mise-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.0.0: Node.js 24 Runtime\u003c/h2\u003e\n\u003cp\u003eA major version bump that updates the action's runtime from Node.js 20 to Node.js 24. GitHub has deprecated Node.js 20 for Actions and will force Node.js 24 as the default starting June 2, 2026. This release proactively adopts the new runtime to eliminate deprecation warnings and ensure continued compatibility.\u003c/p\u003e\n\u003ch2\u003eBreaking Changes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe action now runs on the \u003cstrong\u003eNode.js 24\u003c/strong\u003e runtime instead of Node.js 20. If your workflow pins \u003ccode\u003ejdx/mise-action@v3\u003c/code\u003e, you will continue to see deprecation warnings. Update to \u003ccode\u003ejdx/mise-action@v4\u003c/code\u003e to resolve them:\u003c/p\u003e\n\u003cpre lang=\"yaml\"\u003e\u003ccode\u003e- uses: jdx/mise-action@v4\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eThis should be a seamless upgrade for the vast majority of users — no configuration changes are needed beyond updating the version reference.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eChanged\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated GitHub Actions runtime from Node.js 20 to Node.js 24 by \u003ca href=\"https://github.com/tumerorkun\"\u003e\u003ccode\u003e@​tumerorkun\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/395\"\u003e#395\u003c/a\u003e (fixes \u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/394\"\u003e#394\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tumerorkun\"\u003e\u003ccode\u003e@​tumerorkun\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/395\"\u003e#395\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/jdx/mise-action/compare/v3...v4.0.0\"\u003ehttps://github.com/jdx/mise-action/compare/v3...v4.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.6.3\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: pass cwd to all exec calls in exportMiseEnv() by \u003ca href=\"https://github.com/andrewthauer\"\u003e\u003ccode\u003e@​andrewthauer\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/390\"\u003ejdx/mise-action#390\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: release v3.6.3 by \u003ca href=\"https://github.com/mise-en-dev\"\u003e\u003ccode\u003e@​mise-en-dev\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/391\"\u003ejdx/mise-action#391\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/andrewthauer\"\u003e\u003ccode\u003e@​andrewthauer\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/390\"\u003ejdx/mise-action#390\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/jdx/mise-action/compare/v3.6.2...v3.6.3\"\u003ehttps://github.com/jdx/mise-action/compare/v3.6.2...v3.6.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.6.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): update dependency prettier to v3.8.1 by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/368\"\u003ejdx/mise-action#368\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency \u003ccode\u003e@​types/node\u003c/code\u003e to v24.10.9 by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/367\"\u003ejdx/mise-action#367\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update github/codeql-action digest to 439137e by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/370\"\u003ejdx/mise-action#370\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): lock file maintenance by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/372\"\u003ejdx/mise-action#372\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update autofix-ci/action digest to 7a166d7 by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/375\"\u003ejdx/mise-action#375\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update actions/checkout digest to de0fac2 by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/374\"\u003ejdx/mise-action#374\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): lock file maintenance by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/377\"\u003ejdx/mise-action#377\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update github/codeql-action digest to b5ebac6 by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/378\"\u003ejdx/mise-action#378\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency \u003ccode\u003e@​types/node\u003c/code\u003e to v24.10.13 by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/379\"\u003ejdx/mise-action#379\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update github/codeql-action digest to f5c2471 by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/380\"\u003ejdx/mise-action#380\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: move file_hash to end of cache key template to prevent prefix matching by \u003ca href=\"https://github.com/altendky\"\u003e\u003ccode\u003e@​altendky\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/384\"\u003ejdx/mise-action#384\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency \u003ccode\u003e@​types/handlebars\u003c/code\u003e to v4.1.0 by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/381\"\u003ejdx/mise-action#381\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): lock file maintenance by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/386\"\u003ejdx/mise-action#386\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update github/codeql-action digest to 4558047 by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/387\"\u003ejdx/mise-action#387\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): lock file maintenance by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/389\"\u003ejdx/mise-action#389\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: release v3.6.2 by \u003ca href=\"https://github.com/mise-en-dev\"\u003e\u003ccode\u003e@​mise-en-dev\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/385\"\u003ejdx/mise-action#385\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jdx/mise-action/blob/main/CHANGELOG.md\"\u003ejdx/mise-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/jdx/mise-action/compare/v4.0.0..v4.0.1\"\u003e4.0.1\u003c/a\u003e - 2026-03-22\u003c/h2\u003e\n\u003ch3\u003e🐛 Bug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003erun npm install in pre-commit hook before build (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/410\"\u003e#410\u003c/a\u003e) by \u003ca href=\"https://github.com/jdx\"\u003e\u003ccode\u003e@​jdx\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/410\"\u003e#410\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e🚜 Refactor\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eextract getCwd() helper to deduplicate working directory resolution (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/403\"\u003e#403\u003c/a\u003e) by \u003ca href=\"https://github.com/altendky\"\u003e\u003ccode\u003e@​altendky\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/403\"\u003e#403\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e📚 Documentation\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebump versions listed im README.md (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/407\"\u003e#407\u003c/a\u003e) by \u003ca href=\"https://github.com/deining\"\u003e\u003ccode\u003e@​deining\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/407\"\u003e#407\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebump more versions listed in README.md (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/408\"\u003e#408\u003c/a\u003e) by \u003ca href=\"https://github.com/deining\"\u003e\u003ccode\u003e@​deining\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/408\"\u003e#408\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e⚙️ Miscellaneous Tasks\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eadd workflow to auto-close stale PRs (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/409\"\u003e#409\u003c/a\u003e) by \u003ca href=\"https://github.com/jdx\"\u003e\u003ccode\u003e@​jdx\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/409\"\u003e#409\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eNew Contributors\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/deining\"\u003e\u003ccode\u003e@​deining\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/408\"\u003e#408\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/jdx/mise-action/compare/v3.6.3..v4.0.0\"\u003e4.0.0\u003c/a\u003e - 2026-03-13\u003c/h2\u003e\n\u003ch3\u003e🚀 Features\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ebreaking\u003c/strong\u003e Update Node.js version from 20 to 24 (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/395\"\u003e#395\u003c/a\u003e) by \u003ca href=\"https://github.com/tumerorkun\"\u003e\u003ccode\u003e@​tumerorkun\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/395\"\u003e#395\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eNew Contributors\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tumerorkun\"\u003e\u003ccode\u003e@​tumerorkun\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/395\"\u003e#395\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/jdx/mise-action/compare/v3.6.2..v3.6.3\"\u003e3.6.3\u003c/a\u003e - 2026-03-06\u003c/h2\u003e\n\u003ch3\u003e🐛 Bug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003epass cwd to all exec calls in exportMiseEnv() (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/390\"\u003e#390\u003c/a\u003e) by \u003ca href=\"https://github.com/andrewthauer\"\u003e\u003ccode\u003e@​andrewthauer\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/390\"\u003e#390\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eNew Contributors\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/andrewthauer\"\u003e\u003ccode\u003e@​andrewthauer\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/390\"\u003e#390\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/jdx/mise-action/compare/v3.6.1..v3.6.2\"\u003e3.6.2\u003c/a\u003e - 2026-03-02\u003c/h2\u003e\n\u003ch3\u003e🐛 Bug Fixes\u003c/h3\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jdx/mise-action/commit/1648a7812b9aeae629881980618f079932869151\"\u003e\u003ccode\u003e1648a78\u003c/code\u003e\u003c/a\u003e chore: release v4.0.1 (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/406\"\u003e#406\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jdx/mise-action/commit/e2d499cca69a193bf3a0996426c5b3ccb94b2c97\"\u003e\u003ccode\u003ee2d499c\u003c/code\u003e\u003c/a\u003e ci: add workflow to auto-close stale PRs (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/409\"\u003e#409\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jdx/mise-action/commit/0cc0f1903615c9dac89b7dea8a31a86bfd9dab51\"\u003e\u003ccode\u003e0cc0f19\u003c/code\u003e\u003c/a\u003e fix: run npm install in pre-commit hook before build (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/410\"\u003e#410\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jdx/mise-action/commit/89c67a39ab4d727fde43e3f8f0f810d8202d34e8\"\u003e\u003ccode\u003e89c67a3\u003c/code\u003e\u003c/a\u003e docs: bump more versions listed in README.md (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/408\"\u003e#408\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jdx/mise-action/commit/0409dde834f41cd7d184340824f5557970508db8\"\u003e\u003ccode\u003e0409dde\u003c/code\u003e\u003c/a\u003e docs: bump versions listed im README.md (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/407\"\u003e#407\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jdx/mise-action/commit/abadabdb1fdc80cf6563f9bd749bf473c860bb5e\"\u003e\u003ccode\u003eabadabd\u003c/code\u003e\u003c/a\u003e refactor: extract getCwd() helper to deduplicate working directory resolution...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jdx/mise-action/commit/c5b2043e51040594ce6979ffd7d682ebbcada18c\"\u003e\u003ccode\u003ec5b2043\u003c/code\u003e\u003c/a\u003e chore(deps): update github/codeql-action digest to 603b797 (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/404\"\u003e#404\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jdx/mise-action/commit/71c0f0ac17abbafcd73c2c637b6f7a5c2c8162c1\"\u003e\u003ccode\u003e71c0f0a\u003c/code\u003e\u003c/a\u003e chore(deps): lock file maintenance (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/400\"\u003e#400\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jdx/mise-action/commit/c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4\"\u003e\u003ccode\u003ec1ecc8f\u003c/code\u003e\u003c/a\u003e chore: release v4.0.0 (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/398\"\u003e#398\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jdx/mise-action/commit/1cbe8c560f203f9ab4eaaf8a3064a85ee965298b\"\u003e\u003ccode\u003e1cbe8c5\u003c/code\u003e\u003c/a\u003e chore(deps): update github/codeql-action digest to 820e316 (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/397\"\u003e#397\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/jdx/mise-action/compare/v2...v4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/upload-artifact` from 4 to 7\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/upload-artifact/releases\"\u003eactions/upload-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003ev7 What's new\u003c/h2\u003e\n\u003ch3\u003eDirect Uploads\u003c/h3\u003e\n\u003cp\u003eAdds support for uploading single files directly (unzipped). Callers can set the new \u003ccode\u003earchive\u003c/code\u003e parameter to \u003ccode\u003efalse\u003c/code\u003e to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The \u003ccode\u003ename\u003c/code\u003e parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.\u003c/p\u003e\n\u003ch3\u003eESM\u003c/h3\u003e\n\u003cp\u003eTo support new versions of the \u003ccode\u003e@actions/*\u003c/code\u003e packages, we've upgraded the package to ESM.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd proxy integration test by \u003ca href=\"https://github.com/Link\"\u003e\u003ccode\u003e@​Link\u003c/code\u003e\u003c/a\u003e- in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/754\"\u003eactions/upload-artifact#754\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade the module to ESM and bump dependencies by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/762\"\u003eactions/upload-artifact#762\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport direct file uploads by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/764\"\u003eactions/upload-artifact#764\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Link\"\u003e\u003ccode\u003e@​Link\u003c/code\u003e\u003c/a\u003e- made their first contribution in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/754\"\u003eactions/upload-artifact#754\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-artifact/compare/v6...v7.0.0\"\u003ehttps://github.com/actions/upload-artifact/compare/v6...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003ev6 - What's new\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!IMPORTANT]\nactions/upload-artifact@v6 now runs on Node.js 24 (\u003ccode\u003eruns.using: node24\u003c/code\u003e) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch3\u003eNode.js 24\u003c/h3\u003e\n\u003cp\u003eThis release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpload Artifact Node 24 support by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/719\"\u003eactions/upload-artifact#719\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update \u003ccode\u003e@​actions/artifact\u003c/code\u003e for Node.js 24 punycode deprecation by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/744\"\u003eactions/upload-artifact#744\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eprepare release v6.0.0 for Node.js 24 support by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/745\"\u003eactions/upload-artifact#745\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0\"\u003ehttps://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBREAKING CHANGE:\u003c/strong\u003e this update supports Node \u003ccode\u003ev24.x\u003c/code\u003e. This is not a breaking change per-se but we're treating it as such.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate README.md by \u003ca href=\"https://github.com/GhadimiR\"\u003e\u003ccode\u003e@​GhadimiR\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/681\"\u003eactions/upload-artifact#681\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca href=\"https://github.com/nebuk89\"\u003e\u003ccode\u003e@​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/712\"\u003eactions/upload-artifact#712\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReadme: spell out the first use of GHES by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/727\"\u003eactions/upload-artifact#727\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate GHES guidance to include reference to Node 20 version by \u003ca href=\"https://github.com/patrikpolyak\"\u003e\u003ccode\u003e@​patrikpolyak\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/725\"\u003eactions/upload-artifact#725\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/artifact\u003c/code\u003e to \u003ccode\u003ev4.0.0\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003ePrepare \u003ccode\u003ev5.0.0\u003c/code\u003e by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/734\"\u003eactions/upload-artifact#734\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a\"\u003e\u003ccode\u003e043fb46\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/797\"\u003e#797\u003c/a\u003e from actions/yacaovsnc/update-dependency\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/634250c1388765ea7ed0f053e636f1f399000b94\"\u003e\u003ccode\u003e634250c\u003c/code\u003e\u003c/a\u003e Include changes in typespec/ts-http-runtime 0.3.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/e454baaac2be505c9450e11b8f3215c6fc023ce8\"\u003e\u003ccode\u003ee454baa\u003c/code\u003e\u003c/a\u003e Readme: bump all the example versions to v7 (\u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/796\"\u003e#796\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/74fad66b98a6d799dc004d3353ccd0e6f6b2530e\"\u003e\u003ccode\u003e74fad66\u003c/code\u003e\u003c/a\u003e Update the readme with direct upload details (\u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/795\"\u003e#795\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f\"\u003e\u003ccode\u003ebbbca2d\u003c/code\u003e\u003c/a\u003e Support direct file uploads (\u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/764\"\u003e#764\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/589182c5a4cec8920b8c1bce3e2fab1c97a02296\"\u003e\u003ccode\u003e589182c\u003c/code\u003e\u003c/a\u003e Upgrade the module to ESM and bump dependencies (\u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/762\"\u003e#762\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/47309c993abb98030a35d55ef7ff34b7fa1074b5\"\u003e\u003ccode\u003e47309c9\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/754\"\u003e#754\u003c/a\u003e from actions/Link-/add-proxy-integration-tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/02a8460834e70dab0ce194c64360c59dc1475ef0\"\u003e\u003ccode\u003e02a8460\u003c/code\u003e\u003c/a\u003e Add proxy integration test\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/b7c566a772e6b6bfb58ed0dc250532a479d7789f\"\u003e\u003ccode\u003eb7c566a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/745\"\u003e#745\u003c/a\u003e from actions/upload-artifact-v6-release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/e516bc8500aaf3d07d591fcd4ae6ab5f9c391d5b\"\u003e\u003ccode\u003ee516bc8\u003c/code\u003e\u003c/a\u003e docs: correct description of Node.js 24 support in README\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/upload-artifact/compare/v4...v7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `DavidAnson/markdownlint-cli2-action` from 17 to 23\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/davidanson/markdownlint-cli2-action/releases\"\u003eDavidAnson/markdownlint-cli2-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eUpdate markdownlint-cli2 version (markdownlint-cli2 v0.22.1, markdownlint v0.40.0).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint-cli2 version (markdownlint-cli2 v0.22.0, markdownlint v0.40.0), update Node.js dependency to 24.\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.20.0, markdownlint v0.40.0).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.19.0, markdownlint v0.39.0).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.18.1, markdownlint v0.38.0).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.17.2, markdownlint v0.37.4).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.17.0, markdownlint v0.37.0).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.15.0, markdownlint v0.36.1).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.14.0, markdownlint v0.35.0).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.13.0, markdownlint v0.34.0).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003cp\u003eUpdate markdownlint version (markdownlint-cli2 v0.12.1, markdownlint v0.33.0).\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.11.0, markdownlint v0.32.1), remove deprecated \u0026quot;command\u0026quot; input.\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.10.0, markdownlint v0.31.1).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.9.2, markdownlint v0.30.0).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.8.1, markdownlint v0.29.0), add \u0026quot;config\u0026quot; and \u0026quot;fix\u0026quot; inputs, deprecate \u0026quot;command\u0026quot; input.\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.7.1, markdownlint v0.28.2).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.7.0, markdownlint v0.28.1), include link to rule information in title of annotations (clickable in GitHub).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DavidAnson/markdownlint-cli2-action/commit/ded1f9488f68a970bc66ea5619e13e9b52e601cd\"\u003e\u003ccode\u003eded1f94\u003c/code\u003e\u003c/a\u003e Update to version 23.2.0.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DavidAnson/markdownlint-cli2-action/commit/dc5dad9f8ba073d9c126e0d851df92a6d37edf73\"\u003e\u003ccode\u003edc5dad9\u003c/code\u003e\u003c/a\u003e Add 10-day cooldown period to Dependabot updates.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DavidAnson/markdownlint-cli2-action/commit/64b1c6ae183a8eb20a1aa3953e30a9dd4d432402\"\u003e\u003ccode\u003e64b1c6a\u003c/code\u003e\u003c/a\u003e Add package-lock.json for reproducible builds (fixes \u003ca href=\"https://redirect.github.com/davidanson/markdownlint-cli2-action/issues/362\"\u003e#362\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DavidAnson/markdownlint-cli2-action/commit/6c62e06b9a7e92ae00b281d5c6794123911021af\"\u003e\u003ccode\u003e6c62e06\u003c/code\u003e\u003c/a\u003e Bump eslint-plugin-n from 17.24.0 to 18.0.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DavidAnson/markdownlint-cli2-action/commit/9b5720cdbb216ebfd0f8ebfcd1b213c83ed1b206\"\u003e\u003ccode\u003e9b5720c\u003c/code\u003e\u003c/a\u003e Bump eslint from 10.2.1 to 10.3.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DavidAnson/markdownlint-cli2-action/commit/6b51ade7a9e4a75a7ad929842dd298a3804ebe8b\"\u003e\u003ccode\u003e6b51ade\u003c/code\u003e\u003c/a\u003e Update to version 23.1.0.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DavidAnson/markdownlint-cli2-action/commit/ea6e0dad81a67897db7632a0a41b3a0e7cc03ca3\"\u003e\u003ccode\u003eea6e0da\u003c/code\u003e\u003c/a\u003e Freshen generated index.js file.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DavidAnson/markdownlint-cli2-action/commit/3c4c2c842cd43c2afe7cb5f2ecfe9e1623fa8d14\"\u003e\u003ccode\u003e3c4c2c8\u003c/code\u003e\u003c/a\u003e Bump markdownlint-cli2 from 0.22.0 to 0.22.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DavidAnson/markdownlint-cli2-action/commit/3a933d45e20b54b80131d0335d61186e63e552bd\"\u003e\u003ccode\u003e3a933d4\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/core\u003c/code\u003e from 3.0.0 to 3.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DavidAnson/markdownlint-cli2-action/commit/648042e2afed596b673a8b3f8fc8fbfb48b41f43\"\u003e\u003ccode\u003e648042e\u003c/code\u003e\u003c/a\u003e Freshen generated index.js file.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/davidanson/markdownlint-cli2-action/compare/v17...v23\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `docker/setup-buildx-action` from 3 to 4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/docker/setup-buildx-action/releases\"\u003edocker/setup-buildx-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eNode 24 as default runtime (requires \u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003eActions Runner v2.327.1\u003c/a\u003e or later) by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/483\"\u003edocker/setup-buildx-action#483\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove deprecated inputs/outputs by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/464\"\u003edocker/setup-buildx-action#464\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSwitch to ESM and update config/test wiring by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/481\"\u003edocker/setup-buildx-action#481\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e from 1.11.1 to 3.0.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/475\"\u003edocker/setup-buildx-action#475\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.63.0 to 0.79.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/482\"\u003edocker/setup-buildx-action#482\u003c/a\u003e \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/485\"\u003edocker/setup-buildx-action#485\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.0 to 4.1.1 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/452\"\u003edocker/setup-buildx-action#452\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump lodash from 4.17.21 to 4.17.23 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/472\"\u003edocker/setup-buildx-action#472\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump minimatch from 3.1.2 to 3.1.5 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/480\"\u003edocker/setup-buildx-action#480\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/v3.12.0...v4.0.0\"\u003ehttps://github.com/docker/setup-buildx-action/compare/v3.12.0...v4.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.12.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeprecate \u003ccode\u003einstall\u003c/code\u003e input by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/455\"\u003edocker/setup-buildx-action#455\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.62.1 to 0.63.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/434\"\u003edocker/setup-buildx-action#434\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump brace-expansion from 1.1.11 to 1.1.12 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/436\"\u003edocker/setup-buildx-action#436\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump form-data from 2.5.1 to 2.5.5 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/432\"\u003edocker/setup-buildx-action#432\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 5.28.4 to 5.29.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/435\"\u003edocker/setup-buildx-action#435\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/v3.11.1...v3.12.0\"\u003ehttps://github.com/docker/setup-buildx-action/compare/v3.11.1...v3.12.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.11.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix \u003ccode\u003ekeep-state\u003c/code\u003e not being respected by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/429\"\u003edocker/setup-buildx-action#429\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/v3.11.0...v3.11.1\"\u003ehttps://github.com/docker/setup-buildx-action/compare/v3.11.0...v3.11.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.11.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eKeep BuildKit state support by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/427\"\u003edocker/setup-buildx-action#427\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove aliases created when installing by default by \u003ca href=\"https://github.com/hashhar\"\u003e\u003ccode\u003e@​hashhar\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/139\"\u003edocker/setup-buildx-action#139\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.56.0 to 0.62.1 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/422\"\u003edocker/setup-buildx-action#422\u003c/a\u003e \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/425\"\u003edocker/setup-buildx-action#425\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/v3.10.0...v3.11.0\"\u003ehttps://github.com/docker/setup-buildx-action/compare/v3.10.0...v3.11.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.10.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.54.0 to 0.56.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/408\"\u003edocker/setup-buildx-action#408\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/v3.9.0...v3.10.0\"\u003ehttps://github.com/docker/setup-buildx-action/compare/v3.9.0...v3.10.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.9.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.48.0 to 0.54.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/402\"\u003edocker/setup-buildx-action#402\u003c/a\u003e \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/404\"\u003edocker/setup-buildx-action#404\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/v3.8.0...v3.9.0\"\u003ehttps://github.com/docker/setup-buildx-action/compare/v3.8.0...v3.9.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.8.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMake cloud prefix optional to download buildx if driver is cloud by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/390\"\u003edocker/setup-buildx-action#390\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e from 1.10.1 to 1.11.1 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/370\"\u003edocker/setup-buildx-action#370\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.39.0 to 0.48.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/389\"\u003edocker/setup-buildx-action#389\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump cross-spawn from 7.0.3 to 7.0.6 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/382\"\u003edocker/setup-buildx-action#382\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/v3.7.1...v3.8.0\"\u003ehttps://github.com/docker/setup-buildx-action/compare/v3.7.1...v3.8.0\u003c/a\u003e\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5\"\u003e\u003ccode\u003ed7f5e7f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/489\"\u003e#489\u003c/a\u003e from docker/dependabot/npm_and_yarn/docker/actions-to...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/92bc5c9777806d0a73d9d668ba2114fa1177f164\"\u003e\u003ccode\u003e92bc5c9\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/da11e35abee0f20cb4f1c1b7c461d37c29be52f5\"\u003e\u003ccode\u003eda11e35\u003c/code\u003e\u003c/a\u003e build(deps): bump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.79.0 to 0.90.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/f021e162ef95b6fba51af1c6674f537f25bce851\"\u003e\u003ccode\u003ef021e16\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/492\"\u003e#492\u003c/a\u003e from docker/dependabot/npm_and_yarn/undici-6.24.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/b5af94fab700aee0c64d6077e0e34ae987815b67\"\u003e\u003ccode\u003eb5af94f\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/16ad9776a801d0c47f0a05f007b88a3789aa8ab6\"\u003e\u003ccode\u003e16ad977\u003c/code\u003e\u003c/a\u003e build(deps): bump undici from 6.23.0 to 6.25.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/d7a12d7df895b33bd02a9b4bf62a12f2b9a24458\"\u003e\u003ccode\u003ed7a12d7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/495\"\u003e#495\u003c/a\u003e from docker/dependabot/npm_and_yarn/glob-10.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/28ff27de4eed7518d361591f2cd1dfb69c34a7cb\"\u003e\u003ccode\u003e28ff27d\u003c/code\u003e\u003c/a\u003e build(deps): bump glob from 10.3.12 to 13.0.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/daf436b50e13d9053b9730cbc16516891878b019\"\u003e\u003ccode\u003edaf436b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/496\"\u003e#496\u003c/a\u003e from docker/dependabot/npm_and_yarn/fast-xml-parser-5...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/9725348367859764880f2f2e688a6b0c353e3f35\"\u003e\u003ccode\u003e9725348\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/v3...v4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `docker/bake-action` from 6 to 7\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/docker/bake-action/releases\"\u003edocker/bake-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eNode 24 as default runtime (requires \u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003eActions Runner v2.327.1\u003c/a\u003e or later) by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/383\"\u003edocker/bake-action#383\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eworkdir\u003c/code\u003e input is now merged into \u003ccode\u003esource\u003c/code\u003e; use \u003ccode\u003esource\u003c/code\u003e for local and remote (\u003ca href=\"https://github.com/docker/bake-action?tab=readme-ov-file#source-semantics\"\u003edocs\u003c/a\u003e) by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/365\"\u003edocker/bake-action#365\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove deprecated \u003ccode\u003eDOCKER_BUILD_NO_SUMMARY\u003c/code\u003e and \u003ccode\u003eDOCKER_BUILD_EXPORT_RETENTION_DAYS\u003c/code\u003e envs by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/386\"\u003edocker/bake-action#386\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove legacy export-build tool support for build summary by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/387\"\u003edocker/bake-action#387\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove deprecated \u003ccode\u003elist-targets\u003c/code\u003e subaction (use \u003ca href=\"https://github.com/docker/bake-action/tree/master/subaction/matrix\"\u003e\u003ccode\u003ematrix\u003c/code\u003e subaction\u003c/a\u003e instead) by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/370\"\u003edocker/bake-action#370\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSwitch to ESM and update config/test wiring by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/380\"\u003edocker/bake-action#380\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e from 1.11.1 to 3.0.0 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/382\"\u003edocker/bake-action#382\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.68.0 to 0.79.0 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/381\"\u003edocker/bake-action#381\u003c/a\u003e \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/384\"\u003edocker/bake-action#384\u003c/a\u003e \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/389\"\u003edocker/bake-action#389\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​isaacs/brace-expansion\u003c/code\u003e from 5.0.0 to 5.0.1 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/379\"\u003edocker/bake-action#379\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump lodash from 4.17.21 to 4.17.23 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/376\"\u003edocker/bake-action#376\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/bake-action/compare/v6.10.0...v7.0.0\"\u003ehttps://github.com/docker/bake-action/compare/v6.10.0...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.10.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck provenance attestation set in bake definition before overriding by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/359\"\u003edocker/bake-action#359\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.63.0 to 0.68.0 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/360\"\u003edocker/bake-action#360\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 3.14.1 to 3.14.2 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/357\"\u003edocker/bake-action#357\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/bake-action/compare/v6.9.0...v6.10.0\"\u003ehttps://github.com/docker/bake-action/compare/v6.9.0...v6.10.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.9.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ca href=\"https://github.com/docker/bake-action/blob/master/subaction/matrix\"\u003e\u003ccode\u003ematrix\u003c/code\u003e\u003c/a\u003e subaction and deprecate \u003ccode\u003elist-targets\u003c/code\u003e by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/204\"\u003edocker/bake-action#204\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003ecall\u003c/code\u003e input to set method for evaluating build by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/338\"\u003edocker/bake-action#338\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.62.1 to 0.63.0 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/342\"\u003edocker/bake-action#342\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump brace-expansion from 1.1.11 to 1.1.12 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/339\"\u003edocker/bake-action#339\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump form-data from 2.5.1 to 2.5.5 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/334\"\u003edocker/bake-action#334\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump tmp from 0.2.3 to 0.2.4 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/341\"\u003edocker/bake-action#341\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 5.28.4 to 5.29.0 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/340\"\u003edocker/bake-action#340\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!IMPORTANT]\n\u003ca href=\"https://github.com/docker/bake-action/tree/v6.9.0/subaction/list-targets\"\u003e\u003ccode\u003edocker/bake-action/subaction/list-targets\u003c/code\u003e\u003c/a\u003e is deprecated and will be removed in a future release.\nPlease use \u003ca href=\"https://github.com/docker/bake-action/blob/master/subaction/matrix\"\u003e\u003ccode\u003edocker/bake-action/subaction/matrix\u003c/code\u003e\u003c/a\u003e instead.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/bake-action/compare/v6.8.0...v6.9.0\"\u003ehttps://github.com/docker/bake-action/compare/v6.8.0...v6.9.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.8.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.61.0 to 0.62.1 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/331\"\u003edocker/bake-action#331\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!NOTE]\n\u003ca href=\"https://docs.docker.com/build/ci/github-actions/build-summary/\"\u003eBuild summary\u003c/a\u003e is now supported with \u003ca href=\"https://docs.docker.com/build-cloud/\"\u003eDocker Build Cloud\u003c/a\u003e.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/bake-action/compare/v6.7.0...v6.8.0\"\u003ehttps://github.com/docker/bake-action/compare/v6.7.0...v6.8.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.7.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.59.0 to 0.61.0 by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/325\"\u003edocker/bake-action#325\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!NOTE]\nBuild record is now exported using the \u003ca href=\"https://docs.docker.com/reference/cli/docker/buildx/history/export/\"\u003e\u003ccode\u003ebuildx history export\u003c/code\u003e\u003c/a\u003e command instead of the legacy export-build tool.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/bake-action/commit/6614cfa25eff9a0b2b2697efb0b6159e7680d584\"\u003e\u003ccode\u003e6614cfa\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/bake-action/issues/425\"\u003e#425\u003c/a\u003e from docker/dependabot/npm_and_yarn/docker/actions-to...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/bake-action/commit/0a925a2f441ed5b98093a5f22bf394d4f7f90fe1\"\u003e\u003ccode\u003e0a925a2\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/bake-action/commit/b9ca7428b9db7ce99fd53cbb841e7fe2e4398e14\"\u003e\u003ccode\u003eb9ca742\u003c/code\u003e\u003c/a\u003e chore(deps): Bump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.87.0 to 0.90.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/bake-action/commit/48e6359a4a84f8878f508f6b40522cec98458a84\"\u003e\u003ccode\u003e48e6359\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/bake-action/issues/429\"\u003e#429\u003c/a\u003e from docker/dependabot/npm_and_yarn/fast-xml-parser-5...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/bake-action/commit/d1523f495ad477e665fb3791b34ebf03cd94a84a\"\u003e\u003ccode\u003ed1523f4\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/bake-action/commit/a73f293b0b9bee84f5b67dea49ed4df47bcb7ec5\"\u003e\u003ccode\u003ea73f293\u003c/code\u003e\u003c/a\u003e chore(deps): Bump fast-xml-parser from 5.5.9 to 5.8.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/bake-action/commit/bc584acc2abd0dcd4af6aa2d22c8d8fe0c1a1b3e\"\u003e\u003ccode\u003ebc584ac\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/bake-action/issues/430\"\u003e#430\u003c/a\u003e from docker/dependabot/npm_and_yarn/actions/core-3.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/bake-action/commit/23050a11b3ba889f5d9d8661ab17ae5bd50ce163\"\u003e\u003ccode\u003e23050a1\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/bake-action/commit/7ae1cf6599093238db3b9873f3591f3c566d9840\"\u003e\u003ccode\u003e7ae1cf6\u003c/code\u003e\u003c/a\u003e chore(deps): Bump \u003ccode\u003e@​actions/core\u003c/code\u003e from 3.0.0 to 3.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/bake-action/commit/e7934f83947a97c36e6e96d97ec3f299d987c7b8\"\u003e\u003ccode\u003ee7934f8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/bake-action/issues/432\"\u003e#432\u003c/a\u003e from docker/dependabot/npm_and_yarn/postcss-8.5.10\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/docker/bake-action/compare/v6...v7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action` from 2.2.4 to 2.3.8\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.5\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.5.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to v2.3.5 by \u003ca href=\"https://github.com/tobyhawker\"\u003e\u003ccode\u003e@​tobyhawker\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/124\"\u003egoogle/osv-scanner-action#124\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tobyhawker\"\u003e\u003ccode\u003e@​tobyhawker\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/124\"\u003egoogle/osv-scanner-action#124\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.3...v2.3.5\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.3...v2.3.5\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.3\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.3.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): update github/codeql-action action to v4.31.10 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/115\"\u003egoogle/osv-scanner-action#115\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate to v2.3.3 by \u003ca href=\"https://github.com/Ly-Joey\"\u003e\u003ccode\u003e@​Ly-Joey\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/118\"\u003egoogle/osv-scanner-action#118\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Ly-Joey\"\u003e\u003ccode\u003e@​Ly-Joey\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/118\"\u003egoogle/osv-scanner-action#118\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.2...v2.3.3\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.2...v2.3.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.2\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.2\u003c/p\u003e\n\u003cp\u003eThis release includes performance improvements for local scanning, reducing memory usage and avoiding unnecessary advisory loading. It also fixes issues with MCP's get_vulnerability_details tool, git queries in \u003ccode\u003eosv-scanner.json\u003c/code\u003e, and ignore entry tracking, along with documentation updates.\u003c/p\u003e\n\u003ch3\u003eFixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2415\"\u003e#2415\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2415\"\u003egoogle/osv-scanner#2415\u003c/a\u003e) Add more PURL-to-ecosystem mappings\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2422\"\u003e#2422\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2422\"\u003egoogle/osv-scanner#2422\u003c/a\u003e) MCP error for get_vulnerability_id because type definition is incorrect.\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2460\"\u003e#2460\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2460\"\u003egoogle/osv-scanner#2460\u003c/a\u003e) Enable osv-scanner.json git queries\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2456\"\u003e#2456\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2456\"\u003egoogle/osv-scanner#2456\u003c/a\u003e) Properly track if an ignore entry has been used\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2450\"\u003e#2450\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2450\"\u003egoogle/osv-scanner#2450\u003c/a\u003e) \u003cstrong\u003ePerformance:\u003c/strong\u003e Avoid loading the entire advisory unless it will actually be used\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2445\"\u003e#2445\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2445\"\u003egoogle/osv-scanner#2445\u003c/a\u003e) \u003cstrong\u003ePerformance:\u003c/strong\u003e Don't read the entire zip into memory\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2433\"\u003e#2433\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2433\"\u003egoogle/osv-scanner#2433\u003c/a\u003e) Allow specifying user agent in v2 osvscanner package\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMisc:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e[Misc \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2453\"\u003e#2453\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2453\"\u003egoogle/osv-scanner#2453\u003c/a\u003e) Switch from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3\u003c/li\u003e\n\u003cli\u003e[Misc \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2447\"\u003e#2447\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2447\"\u003egoogle/osv-scanner#2447\u003c/a\u003e) Include \u003ccode\u003ebun.lock\u003c/code\u003e as a supported lockfile\u003c/li\u003e\n\u003cli\u003e[Misc \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2444\"\u003e#2444\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2444\"\u003egoogle/osv-scanner#2444\u003c/a\u003e) Document GoVersionOverride in configuration.md\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9517144e5504957104c831530fe605bfdc71f353\"\u003e\u003ccode\u003e9517144\u003c/code\u003e\u003c/a\u003e feat: output results in reusable workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f17cd09224d6ef8be953fb49371e6bffb2dbf44a\"\u003e\u003ccode\u003ef17cd09\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into main\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.2.4...v2.3.8\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action` from 3 to 4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.36.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.19.4. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev3.35.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal \u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will be enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for GitHub-internal use only, and may change without notice at any time. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning analysis for a PR with \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev3.35.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev3.35.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP OIDC are now accepted. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBest-effort connection tests for private registries now use \u003ccode\u003eGET\u003c/code\u003e requests instead of \u003ccode\u003eHEAD\u003c/code\u003e for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3853\"\u003e#3853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3\"\u003e2.25.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3865\"\u003e#3865\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev3.35.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe undocumented TRAP cache cleanup feature that could be enabled using the \u003ccode\u003eCODEQL_ACTION_CLEANUP_TRAP_CACHES\u003c/code\u003e environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the \u003ccode\u003etrap-caching: false\u003c/code\u003e input to the \u003ccode\u003einit\u003c/code\u003e Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3795\"\u003e#3795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3789\"\u003e#3789\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePython analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3794\"\u003e#3794\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3807\"\u003e#3807\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2\"\u003e2.25.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3823\"\u003e#3823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev3.35.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix incorrect minimum required Git version for \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e: it should have been 2.36.0, not 2.11.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3781\"\u003e#3781\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev3.35.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReduced the minimum Git version required for \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e from 2.38.0 to 2.11.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3767\"\u003e#3767\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1\"\u003e2.25.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3773\"\u003e#3773\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev3.34.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDowngrade default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3\"\u003e2.24.3\u003c/a\u003e due to issues with a small percentage of Actions and JavaScript analyses. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3762\"\u003e#3762\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev3.34.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded an experimental change which disables TRAP caching...\n\n_Description has been truncated_","html_url":"https://github.com/theagenticguy/agent-images/pull/4","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/theagenticguy%2Fagent-images/issues/4","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/4/packages"},{"uuid":"4552609009","node_id":"PR_kwDOSe3Vr87g2yS6","number":3,"state":"open","title":"chore(deps): bump the github-actions group across 1 directory with 15 updates","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-05-30T01:01:56.000Z","updated_at":"2026-06-27T02:01:29.688Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"github-actions","update_count":15,"packages":[{"name":"actions/checkout","old_version":"3.1.0","new_version":"6.0.2","repository_url":"https://github.com/actions/checkout"},{"name":"step-security/harden-runner","old_version":"2.19.0","new_version":"2.19.4","repository_url":"https://github.com/step-security/harden-runner"},{"name":"golangci/golangci-lint-action","old_version":"9.2.0","new_version":"9.2.1","repository_url":"https://github.com/golangci/golangci-lint-action"},{"name":"codecov/codecov-action","old_version":"6.0.0","new_version":"6.0.1","repository_url":"https://github.com/codecov/codecov-action"},{"name":"github/codeql-action","old_version":"2.1.36","new_version":"4.36.0","repository_url":"https://github.com/github/codeql-action"},{"name":"actions/dependency-review-action","old_version":"4.9.0","new_version":"5.0.0","repository_url":"https://github.com/actions/dependency-review-action"},{"name":"goreleaser/goreleaser-action","old_version":"7.2.1","new_version":"7.2.2","repository_url":"https://github.com/goreleaser/goreleaser-action"},{"name":"actions/labeler","old_version":"6.0.1","new_version":"6.1.0","repository_url":"https://github.com/actions/labeler"},{"name":"google/osv-scanner-action","old_version":"2.3.5","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"release-drafter/release-drafter","old_version":"7.2.1","new_version":"7.3.1","repository_url":"https://github.com/release-drafter/release-drafter"},{"name":"sigstore/cosign-installer","old_version":"4.1.1","new_version":"4.1.2","repository_url":"https://github.com/sigstore/cosign-installer"},{"name":"docker/setup-qemu-action","old_version":"4.0.0","new_version":"4.1.0","repository_url":"https://github.com/docker/setup-qemu-action"},{"name":"docker/setup-buildx-action","old_version":"4.0.0","new_version":"4.1.0","repository_url":"https://github.com/docker/setup-buildx-action"},{"name":"docker/login-action","old_version":"4.1.0","new_version":"4.2.0","repository_url":"https://github.com/docker/login-action"},{"name":"crate-ci/typos","old_version":"1.45.2","new_version":"1.47.0","repository_url":"https://github.com/crate-ci/typos"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions group with 15 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/checkout](https://github.com/actions/checkout) | `3.1.0` | `6.0.2` |\n| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.19.0` | `2.19.4` |\n| [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `9.2.0` | `9.2.1` |\n| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `6.0.0` | `6.0.1` |\n| [github/codeql-action](https://github.com/github/codeql-action) | `2.1.36` | `4.36.0` |\n| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.9.0` | `5.0.0` |\n| [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `7.2.1` | `7.2.2` |\n| [actions/labeler](https://github.com/actions/labeler) | `6.0.1` | `6.1.0` |\n| [google/osv-scanner-action](https://github.com/google/osv-scanner-action) | `2.3.5` | `2.3.8` |\n| [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) | `7.2.1` | `7.3.1` |\n| [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `4.1.1` | `4.1.2` |\n| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `4.0.0` | `4.1.0` |\n| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.0.0` | `4.1.0` |\n| [docker/login-action](https://github.com/docker/login-action) | `4.1.0` | `4.2.0` |\n| [crate-ci/typos](https://github.com/crate-ci/typos) | `1.45.2` | `1.47.0` |\n\n\nUpdates `actions/checkout` from 3.1.0 to 6.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/releases\"\u003eactions/checkout's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by \u003ca href=\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2355\"\u003eactions/checkout#2355\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6.0.1...v6.0.2\"\u003ehttps://github.com/actions/checkout/compare/v6.0.1...v6.0.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all references from v5 and v4 to v6 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2314\"\u003eactions/checkout#2314\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eClarify v6 README by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2328\"\u003eactions/checkout#2328\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6...v6.0.1\"\u003ehttps://github.com/actions/checkout/compare/v6...v6.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ev6-beta by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2298\"\u003eactions/checkout#2298\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate readme/changelog for v6 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2311\"\u003eactions/checkout#2311\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v5.0.0...v6.0.0\"\u003ehttps://github.com/actions/checkout/compare/v5.0.0...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6-beta\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eUpdated persist-credentials to store the credentials under \u003ccode\u003e$RUNNER_TEMP\u003c/code\u003e instead of directly in the local git config.\u003c/p\u003e\n\u003cp\u003eThis requires a minimum Actions Runner version of \u003ca href=\"https://github.com/actions/runner/releases/tag/v2.329.0\"\u003ev2.329.0\u003c/a\u003e to access the persisted credentials for \u003ca href=\"https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action\"\u003eDocker container action\u003c/a\u003e scenarios.\u003c/p\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v5...v5.0.1\"\u003ehttps://github.com/actions/checkout/compare/v5...v5.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare v5.0.0 release by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2238\"\u003eactions/checkout#2238\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e⚠️ Minimum Compatible Runner Version\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003ev2.327.1\u003c/strong\u003e\u003cbr /\u003e\n\u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003eRelease Notes\u003c/a\u003e\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\"\u003eactions/checkout's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v4 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2305\"\u003eactions/checkout#2305\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update README.md by \u003ca href=\"https://github.com/motss\"\u003e\u003ccode\u003e@​motss\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1971\"\u003eactions/checkout#1971\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd internal repos for checking out multiple repositories by \u003ca href=\"https://github.com/mouismail\"\u003e\u003ccode\u003e@​mouismail\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1977\"\u003eactions/checkout#1977\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation update - add recommended permissions to Readme by \u003ca href=\"https://github.com/benwells\"\u003e\u003ccode\u003e@​benwells\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2043\"\u003eactions/checkout#2043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdjust positioning of user email note and permissions heading by \u003ca href=\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2044\"\u003eactions/checkout#2044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca href=\"https://github.com/nebuk89\"\u003e\u003ccode\u003e@​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2194\"\u003eactions/checkout#2194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate CODEOWNERS for actions by \u003ca href=\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2224\"\u003eactions/checkout#2224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate package dependencies by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2236\"\u003eactions/checkout#2236\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eurl-helper.ts\u003c/code\u003e now leverages well-known environment variables by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1941\"\u003eactions/checkout#1941\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpand unit test coverage for \u003ccode\u003eisGhes\u003c/code\u003e by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1946\"\u003eactions/checkout#1946\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck out other refs/* by commit if provided, fall back to ref by \u003ca href=\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1924\"\u003eactions/checkout#1924\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd Ref and Commit outputs by \u003ca href=\"https://github.com/lucacome\"\u003e\u003ccode\u003e@​lucacome\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1180\"\u003eactions/checkout#1180\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDependency updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e- \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1777\"\u003eactions/checkout#1777\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1872\"\u003eactions/checkout#1872\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.1.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1739\"\u003eactions/checkout#1739\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 3 to 4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1697\"\u003eactions/checkout#1697\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCheck out other refs/* by commit by \u003ca href=\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1774\"\u003eactions/checkout#1774\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin actions/checkout's own workflows to a known, good, stable version. by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1776\"\u003eactions/checkout#1776\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.1.6\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck platform to set archive extension appropriately by \u003ca href=\"https://github.com/cory-miller\"\u003e\u003ccode\u003e@​cory-miller\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1732\"\u003eactions/checkout#1732\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/de0fac2e4500dabe0009e67214ff5f5447ce83dd\"\u003e\u003ccode\u003ede0fac2\u003c/code\u003e\u003c/a\u003e Fix tag handling: preserve annotations and explicit fetch-tags (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2356\"\u003e#2356\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/064fe7f3312418007dea2b49a19844a9ee378f49\"\u003e\u003ccode\u003e064fe7f\u003c/code\u003e\u003c/a\u003e Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/8e8c483db84b4bee98b60c0593521ed34d9990e8\"\u003e\u003ccode\u003e8e8c483\u003c/code\u003e\u003c/a\u003e Clarify v6 README (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2328\"\u003e#2328\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/033fa0dc0b82693d8986f1016a0ec2c5e7d9cbb1\"\u003e\u003ccode\u003e033fa0d\u003c/code\u003e\u003c/a\u003e Add worktree support for persist-credentials includeIf (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2327\"\u003e#2327\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5\"\u003e\u003ccode\u003ec2d88d3\u003c/code\u003e\u003c/a\u003e Update all references from v5 and v4 to v6 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2314\"\u003e#2314\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3\"\u003e\u003ccode\u003e1af3b93\u003c/code\u003e\u003c/a\u003e update readme/changelog for v6 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2311\"\u003e#2311\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/71cf2267d89c5cb81562390fa70a37fa40b1305e\"\u003e\u003ccode\u003e71cf226\u003c/code\u003e\u003c/a\u003e v6-beta (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2298\"\u003e#2298\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/069c6959146423d11cd0184e6accf28f9d45f06e\"\u003e\u003ccode\u003e069c695\u003c/code\u003e\u003c/a\u003e Persist creds to a separate file (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2286\"\u003e#2286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493\"\u003e\u003ccode\u003eff7abcd\u003c/code\u003e\u003c/a\u003e Update README to include Node.js 24 support details and requirements (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2248\"\u003e#2248\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/08c6903cd8c0fde910a37f88322edcfb5dd907a8\"\u003e\u003ccode\u003e08c6903\u003c/code\u003e\u003c/a\u003e Prepare v5.0.0 release (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2238\"\u003e#2238\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/checkout/compare/v3.1.0...de0fac2e4500dabe0009e67214ff5f5447ce83dd\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `step-security/harden-runner` from 2.19.0 to 2.19.4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/step-security/harden-runner/releases\"\u003estep-security/harden-runner's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.19.4\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImprovements for HTTPS Monitoring for the Enterprise tier of Harden Runner\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.3...v2.19.4\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.3...v2.19.4\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.3\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDefault to audit mode when api-key missing with use-policy-store by \u003ca href=\"https://github.com/varunsh-coder\"\u003e\u003ccode\u003e@​varunsh-coder\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/665\"\u003estep-security/harden-runner#665\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: detect ubuntu-slim runners early and bail out by \u003ca href=\"https://github.com/devantler\"\u003e\u003ccode\u003e@​devantler\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/657\"\u003estep-security/harden-runner#657\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eWhat the fix changes\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eHarden-Runner will detect \u003ccode\u003eubuntu-slim\u003c/code\u003e runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eWhat the fix does not do\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eJobs running on \u003ccode\u003eubuntu-slim\u003c/code\u003e will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).\u003c/li\u003e\n\u003cli\u003ePer GitHub's docs on \u003ca href=\"https://docs.github.com/en/actions/reference/runners/github-hosted-runners#single-cpu-runners\"\u003esingle-CPU runners\u003c/a\u003e: \u0026quot;The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported.\u0026quot;  Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eFor StepSecurity enterprise customers\nIf your security posture requires that workflows are always monitored, you can block the use of \u003ccode\u003eubuntu-slim\u003c/code\u003e via workflow run policies see the \u003ca href=\"https://docs.stepsecurity.io/workflow-run-policies/policies#runner-label-policy\"\u003eRunner Label Policy\u003c/a\u003e docs. This lets you enforce that jobs only run on monitored runner types.\u003c/p\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/devantler\"\u003e\u003ccode\u003e@​devantler\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/657\"\u003estep-security/harden-runner#657\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/9af89fc71515a100421586dfdb3dc9c984fbf411\"\u003e\u003ccode\u003e9af89fc\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/667\"\u003e#667\u003c/a\u003e from step-security/update-agent-v1.8.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/485dce8cb5d75cda51e8bfa947de06030d080208\"\u003e\u003ccode\u003e485dce8\u003c/code\u003e\u003c/a\u003e Update agent to v1.8.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ab7a9404c0f3da075243ca237b5fac12c98deaa5\"\u003e\u003ccode\u003eab7a940\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/665\"\u003e#665\u003c/a\u003e from step-security/fix/use-policy-store-default-audit\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ec41b783c27ed7f0db6855a6d9970abd4572858c\"\u003e\u003ccode\u003eec41b78\u003c/code\u003e\u003c/a\u003e Default to audit mode when api-key missing with use-policy-store\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/9ca718d3bf646d6534007c269a635b3e54cadf99\"\u003e\u003ccode\u003e9ca718d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/664\"\u003e#664\u003c/a\u003e from step-security/update-agent-v1.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/1dee3df8d29f4225c582eee2ddb6053ca616c0df\"\u003e\u003ccode\u003e1dee3df\u003c/code\u003e\u003c/a\u003e Update agent to v1.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/a5ad31d6a139d249332a2605b85202e8c0b78450\"\u003e\u003ccode\u003ea5ad31d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/657\"\u003e#657\u003c/a\u003e from devantler/fix/ubuntu-slim-user-env\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/6e928567d74554b8842dd434908da31c593ba85c\"\u003e\u003ccode\u003e6e92856\u003c/code\u003e\u003c/a\u003e build dist and trim ubuntu-slim message\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/4e0504ee086374bdec7064e5c26d48af41ba6209\"\u003e\u003ccode\u003e4e0504e\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into fix/ubuntu-slim-user-env\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/376d25a97f3a1640ff8cbbddaa4af25948df2cf3\"\u003e\u003ccode\u003e376d25a\u003c/code\u003e\u003c/a\u003e fix: detect ubuntu-slim runners early and bail out\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/step-security/harden-runner/compare/8d3c67de8e2fe68ef647c8db1e6a09f647780f40...9af89fc71515a100421586dfdb3dc9c984fbf411\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `golangci/golangci-lint-action` from 9.2.0 to 9.2.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/golangci/golangci-lint-action/releases\"\u003egolangci/golangci-lint-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev9.2.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eIMPORTANT: this is the first immutable release.\u003c/p\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003echore: improve workflows by \u003ca href=\"https://github.com/ldez\"\u003e\u003ccode\u003e@​ldez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1394\"\u003egolangci/golangci-lint-action#1394\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependencies\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1325\"\u003egolangci/golangci-lint-action#1325\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1326\"\u003egolangci/golangci-lint-action#1326\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump the dependencies group with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1327\"\u003egolangci/golangci-lint-action#1327\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1328\"\u003egolangci/golangci-lint-action#1328\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 25.0.2 to 25.0.3 in the dependencies group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1329\"\u003egolangci/golangci-lint-action#1329\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1330\"\u003egolangci/golangci-lint-action#1330\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1332\"\u003egolangci/golangci-lint-action#1332\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1333\"\u003egolangci/golangci-lint-action#1333\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump the dependencies group with 6 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1334\"\u003egolangci/golangci-lint-action#1334\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1335\"\u003egolangci/golangci-lint-action#1335\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump the dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1336\"\u003egolangci/golangci-lint-action#1336\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1337\"\u003egolangci/golangci-lint-action#1337\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 25.0.9 to 25.0.10 in the dependencies group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1338\"\u003egolangci/golangci-lint-action#1338\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.3.3 to 5.3.4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1339\"\u003egolangci/golangci-lint-action#1339\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1340\"\u003egolangci/golangci-lint-action#1340\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1344\"\u003egolangci/golangci-lint-action#1344\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.3.4 to 5.3.6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1346\"\u003egolangci/golangci-lint-action#1346\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump minimatch by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1348\"\u003egolangci/golangci-lint-action#1348\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump minimatch from 3.1.3 to 3.1.5 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1350\"\u003egolangci/golangci-lint-action#1350\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.3.6 to 5.4.1 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1351\"\u003egolangci/golangci-lint-action#1351\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.4.1 to 5.5.6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1357\"\u003egolangci/golangci-lint-action#1357\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.5.6 to 5.5.7 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1358\"\u003egolangci/golangci-lint-action#1358\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump flatted from 3.3.3 to 3.4.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1359\"\u003egolangci/golangci-lint-action#1359\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump picomatch from 4.0.3 to 4.0.4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1364\"\u003egolangci/golangci-lint-action#1364\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump yaml from 2.8.2 to 2.8.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1365\"\u003egolangci/golangci-lint-action#1365\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump brace-expansion by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1370\"\u003egolangci/golangci-lint-action#1370\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates by \u003ca href=\"https://github.com/ldez\"\u003e\u003ccode\u003e@​ldez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1374\"\u003egolangci/golangci-lint-action#1374\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 4 to 4.35.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1384\"\u003egolangci/golangci-lint-action#1384\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-builder from 1.1.5 to 1.2.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1386\"\u003egolangci/golangci-lint-action#1386\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1389\"\u003egolangci/golangci-lint-action#1389\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1391\"\u003egolangci/golangci-lint-action#1391\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/golangci/golangci-lint-action/compare/v9.2.0...v9.2.1\"\u003ehttps://github.com/golangci/golangci-lint-action/compare/v9.2.0...v9.2.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/82606bf257cbaff209d206a39f5134f0cfbfd2ee\"\u003e\u003ccode\u003e82606bf\u003c/code\u003e\u003c/a\u003e chore: prepare release v9.2.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/97c8387e660fa3be78f698fb592523e1f906a02c\"\u003e\u003ccode\u003e97c8387\u003c/code\u003e\u003c/a\u003e chore: improve workflows (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1394\"\u003e#1394\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/28d0a191bb76f633872d1f12600dd9900ac73840\"\u003e\u003ccode\u003e28d0a19\u003c/code\u003e\u003c/a\u003e build(deps): bump the dependencies group across 1 directory with 2 updates\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/633fbc7d54a1fe7d54f72fb83194a7d442beb929\"\u003e\u003ccode\u003e633fbc7\u003c/code\u003e\u003c/a\u003e build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1391\"\u003e#1391\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/59f43e26c902dadac745307f8cf2537da50ad344\"\u003e\u003ccode\u003e59f43e2\u003c/code\u003e\u003c/a\u003e build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1389\"\u003e#1389\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/9eb174e04acac69b4b7f6602f9a5cc384ba59b45\"\u003e\u003ccode\u003e9eb174e\u003c/code\u003e\u003c/a\u003e build(deps): bump fast-xml-builder from 1.1.5 to 1.2.0 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1386\"\u003e#1386\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/4f52504dfb47d09a983372e869f643e9e0d4014b\"\u003e\u003ccode\u003e4f52504\u003c/code\u003e\u003c/a\u003e build(deps): bump github/codeql-action from 4 to 4.35.2 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1384\"\u003e#1384\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/6f87dfdbd16618b59a5d86104adea6216152a47c\"\u003e\u003ccode\u003e6f87dfd\u003c/code\u003e\u003c/a\u003e docs: update examples\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/c9500d7aa7797b3e999034a3e6a0b9a4f18e8708\"\u003e\u003ccode\u003ec9500d7\u003c/code\u003e\u003c/a\u003e chore: improve workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/03b1faa37ed78712fa70fc44b56fa553f0d7a6bc\"\u003e\u003ccode\u003e03b1faa\u003c/code\u003e\u003c/a\u003e chore: improve issue templates\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/golangci/golangci-lint-action/compare/1e7e51e771db61008b38414a730f564565cf7c20...82606bf257cbaff209d206a39f5134f0cfbfd2ee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `codecov/codecov-action` from 6.0.0 to 6.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/codecov/codecov-action/releases\"\u003ecodecov/codecov-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: prevent template injection in run: steps (VULN-1652) by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1947\"\u003ecodecov/codecov-action#1947\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(release): 6.0.1 by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1949\"\u003ecodecov/codecov-action#1949\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1\"\u003ehttps://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md\"\u003ecodecov/codecov-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.5.2\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.1\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: overwrite pr number on fork by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1871\"\u003ecodecov/codecov-action#1871\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump actions/checkout from 4.2.2 to 5.0.0 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1868\"\u003ecodecov/codecov-action#1868\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1867\"\u003ecodecov/codecov-action#1867\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update to use local app/ dir by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1872\"\u003ecodecov/codecov-action#1872\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: fix typo in README by \u003ca href=\"https://github.com/datalater\"\u003e\u003ccode\u003e@​datalater\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1866\"\u003ecodecov/codecov-action#1866\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument a \u003ccode\u003ecodecov-cli\u003c/code\u003e version reference example by \u003ca href=\"https://github.com/webknjaz\"\u003e\u003ccode\u003e@​webknjaz\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1774\"\u003ecodecov/codecov-action#1774\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1861\"\u003ecodecov/codecov-action#1861\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1833\"\u003ecodecov/codecov-action#1833\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.0\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efeat: upgrade wrapper to 0.2.4 by \u003ca href=\"https://github.com/jviall\"\u003e\u003ccode\u003e@​jviall\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1864\"\u003ecodecov/codecov-action#1864\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin actions/github-script by Git SHA by \u003ca href=\"https://github.com/martincostello\"\u003e\u003ccode\u003e@​martincostello\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1859\"\u003ecodecov/codecov-action#1859\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: check reqs exist by \u003ca href=\"https://github.com/joseph-sentry\"\u003e\u003ccode\u003e@​joseph-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1835\"\u003ecodecov/codecov-action#1835\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: Typo in README by \u003ca href=\"https://github.com/spalmurray\"\u003e\u003ccode\u003e@​spalmurray\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1838\"\u003ecodecov/codecov-action#1838\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: Refine OIDC docs by \u003ca href=\"https://github.com/spalmurray\"\u003e\u003ccode\u003e@​spalmurray\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1837\"\u003ecodecov/codecov-action#1837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1829\"\u003ecodecov/codecov-action#1829\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.3\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1822\"\u003ecodecov/codecov-action#1822\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: OIDC on forks by \u003ca href=\"https://github.com/joseph-sentry\"\u003e\u003ccode\u003e@​joseph-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1823\"\u003ecodecov/codecov-action#1823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/codecov/codecov-action/commit/e79a6962e0d4c0c17b229090214935d2e33f8354\"\u003e\u003ccode\u003ee79a696\u003c/code\u003e\u003c/a\u003e chore(release): 6.0.1 (\u003ca href=\"https://redirect.github.com/codecov/codecov-action/issues/1949\"\u003e#1949\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/codecov/codecov-action/commit/51e64229ac331acb0d7f7b17c67423995f991c79\"\u003e\u003ccode\u003e51e6422\u003c/code\u003e\u003c/a\u003e fix: prevent template injection in run: steps (VULN-1652) (\u003ca href=\"https://redirect.github.com/codecov/codecov-action/issues/1947\"\u003e#1947\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/codecov/codecov-action/compare/57e3a136b779b570ffcdbf80b3bdc90e7fab3de2...e79a6962e0d4c0c17b229090214935d2e33f8354\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action` from 2.1.36 to 4.36.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.36.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.19.4. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal \u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will be enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for GitHub-internal use only, and may change without notice at any time. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning analysis for a PR with \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP OIDC are now accepted. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBest-effort connection tests for private registries now use \u003ccode\u003eGET\u003c/code\u003e requests instead of \u003ccode\u003eHEAD\u003c/code\u003e for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3853\"\u003e#3853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3\"\u003e2.25.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3865\"\u003e#3865\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe undocumented TRAP cache cleanup feature that could be enabled using the \u003ccode\u003eCODEQL_ACTION_CLEANUP_TRAP_CACHES\u003c/code\u003e environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the \u003ccode\u003etrap-caching: false\u003c/code\u003e input to the \u003ccode\u003einit\u003c/code\u003e Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3795\"\u003e#3795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3789\"\u003e#3789\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePython analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3794\"\u003e#3794\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3807\"\u003e#3807\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2\"\u003e2.25.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3823\"\u003e#3823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix incorrect minimum required Git version for \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e: it should have been 2.36.0, not 2.11.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3781\"\u003e#3781\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReduced the minimum Git version required for \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e from 2.38.0 to 2.11.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3767\"\u003e#3767\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1\"\u003e2.25.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3773\"\u003e#3773\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.34.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDowngrade default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3\"\u003e2.24.3\u003c/a\u003e due to issues with a small percentage of Actions and JavaScript analyses. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3762\"\u003e#3762\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.34.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded an experimental change which disables TRAP caching when \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3569\"\u003e#3569\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eWe are rolling out improved incremental analysis to C/C++ analyses that use build mode \u003ccode\u003enone\u003c/code\u003e. We expect this rollout to be complete by the end of April 2026. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3584\"\u003e#3584\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0\"\u003e2.25.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3585\"\u003e#3585\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.33.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3562\"\u003e#3562\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eTo opt out of this change:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eRepositories owned by an organization:\u003c/strong\u003e Create a custom repository property with the name \u003ccode\u003egithub-codeql-file-coverage-on-prs\u003c/code\u003e and the type \u0026quot;True/false\u0026quot;, then set this property to \u003ccode\u003etrue\u003c/code\u003e in the repository's settings. For more information, see \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003eManaging custom properties for repositories in your organization\u003c/a\u003e. Alternatively, if you are using an advanced setup workflow, you can set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUser-owned repositories using default setup:\u003c/strong\u003e Switch to an advanced setup workflow and set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUser-owned repositories using advanced setup:\u003c/strong\u003e Set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7211b7c8077ea37d8641b6271f6a365a22a5fbfa\"\u003e\u003ccode\u003e7211b7c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3927\"\u003e#3927\u003c/a\u003e from github/update-v4.36.0-ebc2d9e2b\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7740f2fb21add1d46278215acea47540db22f022\"\u003e\u003ccode\u003e7740f2f\u003c/code\u003e\u003c/a\u003e Update changelog for v4.36.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ebc2d9e2bc247eec51bee8d4df806c4030eb0761\"\u003e\u003ccode\u003eebc2d9e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3926\"\u003e#3926\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.25.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d1f74b777c95c777bf4f42ce4b250bc916e745c7\"\u003e\u003ccode\u003ed1f74b7\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/2dc40cec39bdc63d3561d74fa6100cebb0418ff4\"\u003e\u003ccode\u003e2dc40ce\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.25.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/84498526a009a99c875e83ef4821a8ba52de7c22\"\u003e\u003ccode\u003e8449852\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3910\"\u003e#3910\u003c/a\u003e from github/henrymercer/repo-size-diff-check\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/72ac23c6d16b29fbe801e87e3439941558c53094\"\u003e\u003ccode\u003e72ac23c\u003c/code\u003e\u003c/a\u003e Update excluded required check list\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c5297a28a2c3e6a8062041b58858bd7117cebe37\"\u003e\u003ccode\u003ec5297a2\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3919\"\u003e#3919\u003c/a\u003e from github/henrymercer/workflow-concurrency\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8ffeae7d05bc1b914a009d197e64e4f5c9e14503\"\u003e\u003ccode\u003e8ffeae7\u003c/code\u003e\u003c/a\u003e CI: Automatically cancel non-generated workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/f3f52bf568dc44a1069faafa538caa6b1fec40c9\"\u003e\u003ccode\u003ef3f52bf\u003c/code\u003e\u003c/a\u003e Revert \u003ccode\u003egetErrorMessage\u003c/code\u003e import\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/v2.1.36...v4.36.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/dependency-review-action` from 4.9.0 to 5.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/dependency-review-action/releases\"\u003eactions/dependency-review-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e5.0.0\u003c/h2\u003e\n\u003cp\u003eThis is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version \u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003ev2.327.1\u003c/a\u003e to run.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd .github/copilot-instructions.md for Copilot coding agent by \u003ca href=\"https://github.com/ahpook\"\u003e\u003ccode\u003e@​ahpook\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1067\"\u003eactions/dependency-review-action#1067\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate Node.js runtime from 20 to 24 by \u003ca href=\"https://github.com/scottschreckengaust\"\u003e\u003ccode\u003e@​scottschreckengaust\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1084\"\u003eactions/dependency-review-action#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump spdx-license-ids from 3.0.20 to 3.0.23 by \u003ca href=\"https://github.com/mongolyy\"\u003e\u003ccode\u003e@​mongolyy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1091\"\u003eactions/dependency-review-action#1091\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: bump actions/checkout from v4 to v6 in workflow examples by \u003ca href=\"https://github.com/Marukome0743\"\u003e\u003ccode\u003e@​Marukome0743\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1077\"\u003eactions/dependency-review-action#1077\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: patched version display for advisories with non-strict semver ranges (e.g. Maven beta versions) by \u003ca href=\"https://github.com/tspascoal\"\u003e\u003ccode\u003e@​tspascoal\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1076\"\u003eactions/dependency-review-action#1076\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolve security findings by \u003ca href=\"https://github.com/AshelyTC\"\u003e\u003ccode\u003e@​AshelyTC\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1094\"\u003eactions/dependency-review-action#1094\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ev5.0.0 release branch by \u003ca href=\"https://github.com/ahpook\"\u003e\u003ccode\u003e@​ahpook\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1098\"\u003eactions/dependency-review-action#1098\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scottschreckengaust\"\u003e\u003ccode\u003e@​scottschreckengaust\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1084\"\u003eactions/dependency-review-action#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mongolyy\"\u003e\u003ccode\u003e@​mongolyy\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1091\"\u003eactions/dependency-review-action#1091\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Marukome0743\"\u003e\u003ccode\u003e@​Marukome0743\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1077\"\u003eactions/dependency-review-action#1077\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/dependency-review-action/compare/v4.9.0...v5.0.0\"\u003ehttps://github.com/actions/dependency-review-action/compare/v4.9.0...v5.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/a1d282b36b6f3519aa1f3fc636f609c47dddb294\"\u003e\u003ccode\u003ea1d282b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1098\"\u003e#1098\u003c/a\u003e from actions/ahpook/v5-release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/eb6c199c5a85c7387f1f0b02b3ba5c6364740695\"\u003e\u003ccode\u003eeb6c199\u003c/code\u003e\u003c/a\u003e update examples to show \u003ca href=\"https://github.com/v5\"\u003e\u003ccode\u003e@​v5\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/3943c2c5beaaaf1806eb3758273c203dabcbf89c\"\u003e\u003ccode\u003e3943c2c\u003c/code\u003e\u003c/a\u003e v5.0.0 release branch\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/454943c880b147adbfe7de0cdd3ece1c00882033\"\u003e\u003ccode\u003e454943c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1094\"\u003e#1094\u003c/a\u003e from actions/ashelytc/security-findings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/6d92a1228e9e9db334f02c09f84fe9217d2b4463\"\u003e\u003ccode\u003e6d92a12\u003c/code\u003e\u003c/a\u003e revert \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e update\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/a8e5a7e93695b41abf6d1083cd220bee39a720f0\"\u003e\u003ccode\u003ea8e5a7e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1076\"\u003e#1076\u003c/a\u003e from tspascoal/fix-version-matching-for-non-string-s...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/b6b7079031ef4ed61656c221988f1f3bcbf35101\"\u003e\u003ccode\u003eb6b7079\u003c/code\u003e\u003c/a\u003e update \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e to 8.40.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/821a21dd691f162c4c5c2e9754a344accde9a208\"\u003e\u003ccode\u003e821a21d\u003c/code\u003e\u003c/a\u003e update more dependencies\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/05aaaae45cf4c420de012addf2a72e3435ddaa63\"\u003e\u003ccode\u003e05aaaae\u003c/code\u003e\u003c/a\u003e run npm audit fix\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/55d3e754501fc13c84b95637ce51f135012d41ea\"\u003e\u003ccode\u003e55d3e75\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1077\"\u003e#1077\u003c/a\u003e from Marukome0743/docs/checkout\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/dependency-review-action/compare/2031cfc080254a8a887f58cffee85186f0e49e48...a1d282b36b6f3519aa1f3fc636f609c47dddb294\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `goreleaser/goreleaser-action` from 7.2.1 to 7.2.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/goreleaser/goreleaser-action/releases\"\u003egoreleaser/goreleaser-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.2.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eci(deps): bump the actions group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/560\"\u003egoreleaser/goreleaser-action#560\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: nightly resolution to select newest published release by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/562\"\u003egoreleaser/goreleaser-action#562\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/562\"\u003egoreleaser/goreleaser-action#562\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/v7...v7.2.2\"\u003ehttps://github.com/goreleaser/goreleaser-action/compare/v7...v7.2.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89\"\u003e\u003ccode\u003e5daf1e9\u003c/code\u003e\u003c/a\u003e fix: nightly resolution to select newest published release (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/562\"\u003e#562\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/5cc7ebb73d78b8f1d7b03c568e7df999c2889ccf\"\u003e\u003ccode\u003e5cc7ebb\u003c/code\u003e\u003c/a\u003e ci: update actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/702f5f91c9334614254ddeabeebaf820d707f0d6\"\u003e\u003ccode\u003e702f5f9\u003c/code\u003e\u003c/a\u003e ci(deps): bump the actions group with 3 updates (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/560\"\u003e#560\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8...5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/labeler` from 6.0.1 to 6.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/labeler/releases\"\u003eactions/labeler's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.1.0\u003c/h2\u003e\n\u003ch2\u003eEnhancements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd changed-files-labels-limit and max-files-changed configuration options to cap the number of labels added by \u003ca href=\"https://github.com/bluca\"\u003e\u003ccode\u003e@​bluca\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/923\"\u003eactions/labeler#923\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImprove Labeler Action documentation and permission error handling by \u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/897\"\u003eactions/labeler#897\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePreserve manually added labels during workflow runs and refine label synchronization logic by \u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/917\"\u003eactions/labeler#917\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDependency Updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/877\"\u003eactions/labeler#877\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade minimatch from 10.0.1 to 10.2.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/926\"\u003eactions/labeler#926\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade dependencies (\u003ccode\u003e@​actions/core\u003c/code\u003e, \u003ccode\u003e@​actions/github\u003c/code\u003e, js-yaml, minimatch, \u003ca href=\"https://github.com/typescript-eslint\"\u003e\u003ccode\u003e@​typescript-eslint\u003c/code\u003e\u003c/a\u003e) by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/934\"\u003eactions/labeler#934\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/897\"\u003eactions/labeler#897\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/bluca\"\u003e\u003ccode\u003e@​bluca\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/923\"\u003eactions/labeler#923\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/934\"\u003eactions/labeler#934\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/labeler/compare/v6...v6.1.0\"\u003ehttps://github.com/actions/labeler/compare/v6...v6.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/f27b608878404679385c85cfa523b85ccb86e213\"\u003e\u003ccode\u003ef27b608\u003c/code\u003e\u003c/a\u003e chore: upgrade dependencies (\u003ccode\u003e@​actions/core\u003c/code\u003e, \u003ccode\u003e@​actions/github\u003c/code\u003e, js-yaml, minimat...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/c5dadc2a45784a4b6adfcd20fea3465da3a5f904\"\u003e\u003ccode\u003ec5dadc2\u003c/code\u003e\u003c/a\u003e Add 'changed-files-labels-limit' and 'max-files-changed' configs to allow cap...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/e52e4fb63ed5cd0e07abaad9826b2a893ccb921f\"\u003e\u003ccode\u003ee52e4fb\u003c/code\u003e\u003c/a\u003e Bump minimatch from 10.0.1 to 10.2.3 (\u003ca href=\"https://redirect.github.com/actions/labeler/issues/926\"\u003e#926\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/77a4082b841706ac431479b7e2bb11216ffef250\"\u003e\u003ccode\u003e77a4082\u003c/code\u003e\u003c/a\u003e Fix: Preserve manually added labels during workflow run and refine label sync...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/25abb3cad4f14b7ac27968a495c37798860a5a1a\"\u003e\u003ccode\u003e25abb3c\u003c/code\u003e\u003c/a\u003e Improve Labeler Action Documentation and Error Handling for Permissions (\u003ca href=\"https://redirect.github.com/actions/labeler/issues/897\"\u003e#897\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/395c8cfdb1e1e691cc4bad0dd315820af8eb67fd\"\u003e\u003ccode\u003e395c8cf\u003c/code\u003e\u003c/a\u003e Bump brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v...\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/labeler/compare/634933edcd8ababfe52f92936142cc22ac488b1b...f27b608878404679385c85cfa523b85ccb86e213\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action` from 2.3.5 to 2.3.8\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9...\n\n_Description has been truncated_","html_url":"https://github.com/actions-marketplace-validations/afadesigns_zshellcheck/pull/3","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions-marketplace-validations%2Fafadesigns_zshellcheck/issues/3","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/3/packages"},{"uuid":"4530981084","node_id":"PR_kwDOQUkg5c7fwAdQ","number":1335,"state":"open","title":"chore(deps): bump the github-actions group across 1 directory with 12 updates","user":"dependabot[bot]","labels":["deps","ci"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-05-27T08:54:55.000Z","updated_at":"2026-05-31T01:42:27.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"github-actions","update_count":12,"packages":[{"name":"step-security/harden-runner","old_version":"2.19.0","new_version":"2.19.4","repository_url":"https://github.com/step-security/harden-runner"},{"name":"golangci/golangci-lint-action","old_version":"9.2.0","new_version":"9.2.1","repository_url":"https://github.com/golangci/golangci-lint-action"},{"name":"codecov/codecov-action","old_version":"6.0.0","new_version":"6.0.1","repository_url":"https://github.com/codecov/codecov-action"},{"name":"actions/dependency-review-action","old_version":"4.9.0","new_version":"5.0.0","repository_url":"https://github.com/actions/dependency-review-action"},{"name":"goreleaser/goreleaser-action","old_version":"7.2.1","new_version":"7.2.2","repository_url":"https://github.com/goreleaser/goreleaser-action"},{"name":"actions/labeler","old_version":"6.0.1","new_version":"6.1.0","repository_url":"https://github.com/actions/labeler"},{"name":"google/osv-scanner-action","old_version":"2.3.5","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"release-drafter/release-drafter","old_version":"7.2.1","new_version":"7.3.1","repository_url":"https://github.com/release-drafter/release-drafter"},{"name":"sigstore/cosign-installer","old_version":"4.1.1","new_version":"4.1.2","repository_url":"https://github.com/sigstore/cosign-installer"},{"name":"docker/setup-buildx-action","old_version":"4.0.0","new_version":"4.1.0","repository_url":"https://github.com/docker/setup-buildx-action"},{"name":"docker/login-action","old_version":"4.1.0","new_version":"4.2.0","repository_url":"https://github.com/docker/login-action"},{"name":"crate-ci/typos","old_version":"1.45.2","new_version":"1.46.3","repository_url":"https://github.com/crate-ci/typos"}],"path":null,"ecosystem":"actions"},"body":"[//]: # (dependabot-start)\n⚠️  **Dependabot is rebasing this PR** ⚠️ \n\nRebasing might not happen immediately, so don't worry if this takes some time.\n\nNote: if you make any changes to this PR yourself, they will take precedence over the rebase.\n\n---\n\n[//]: # (dependabot-end)\n\nBumps the github-actions group with 12 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.19.0` | `2.19.4` |\n| [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `9.2.0` | `9.2.1` |\n| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `6.0.0` | `6.0.1` |\n| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.9.0` | `5.0.0` |\n| [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `7.2.1` | `7.2.2` |\n| [actions/labeler](https://github.com/actions/labeler) | `6.0.1` | `6.1.0` |\n| [google/osv-scanner-action](https://github.com/google/osv-scanner-action) | `2.3.5` | `2.3.8` |\n| [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) | `7.2.1` | `7.3.1` |\n| [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `4.1.1` | `4.1.2` |\n| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.0.0` | `4.1.0` |\n| [docker/login-action](https://github.com/docker/login-action) | `4.1.0` | `4.2.0` |\n| [crate-ci/typos](https://github.com/crate-ci/typos) | `1.45.2` | `1.46.3` |\n\n\nUpdates `step-security/harden-runner` from 2.19.0 to 2.19.4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/step-security/harden-runner/releases\"\u003estep-security/harden-runner's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.19.4\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImprovements for HTTPS Monitoring for the Enterprise tier of Harden Runner\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.3...v2.19.4\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.3...v2.19.4\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.3\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDefault to audit mode when api-key missing with use-policy-store by \u003ca href=\"https://github.com/varunsh-coder\"\u003e\u003ccode\u003e@​varunsh-coder\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/665\"\u003estep-security/harden-runner#665\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: detect ubuntu-slim runners early and bail out by \u003ca href=\"https://github.com/devantler\"\u003e\u003ccode\u003e@​devantler\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/657\"\u003estep-security/harden-runner#657\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eWhat the fix changes\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eHarden-Runner will detect \u003ccode\u003eubuntu-slim\u003c/code\u003e runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eWhat the fix does not do\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eJobs running on \u003ccode\u003eubuntu-slim\u003c/code\u003e will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).\u003c/li\u003e\n\u003cli\u003ePer GitHub's docs on \u003ca href=\"https://docs.github.com/en/actions/reference/runners/github-hosted-runners#single-cpu-runners\"\u003esingle-CPU runners\u003c/a\u003e: \u0026quot;The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported.\u0026quot;  Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eFor StepSecurity enterprise customers\nIf your security posture requires that workflows are always monitored, you can block the use of \u003ccode\u003eubuntu-slim\u003c/code\u003e via workflow run policies see the \u003ca href=\"https://docs.stepsecurity.io/workflow-run-policies/policies#runner-label-policy\"\u003eRunner Label Policy\u003c/a\u003e docs. This lets you enforce that jobs only run on monitored runner types.\u003c/p\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/devantler\"\u003e\u003ccode\u003e@​devantler\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/657\"\u003estep-security/harden-runner#657\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/9af89fc71515a100421586dfdb3dc9c984fbf411\"\u003e\u003ccode\u003e9af89fc\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/667\"\u003e#667\u003c/a\u003e from step-security/update-agent-v1.8.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/485dce8cb5d75cda51e8bfa947de06030d080208\"\u003e\u003ccode\u003e485dce8\u003c/code\u003e\u003c/a\u003e Update agent to v1.8.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ab7a9404c0f3da075243ca237b5fac12c98deaa5\"\u003e\u003ccode\u003eab7a940\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/665\"\u003e#665\u003c/a\u003e from step-security/fix/use-policy-store-default-audit\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ec41b783c27ed7f0db6855a6d9970abd4572858c\"\u003e\u003ccode\u003eec41b78\u003c/code\u003e\u003c/a\u003e Default to audit mode when api-key missing with use-policy-store\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/9ca718d3bf646d6534007c269a635b3e54cadf99\"\u003e\u003ccode\u003e9ca718d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/664\"\u003e#664\u003c/a\u003e from step-security/update-agent-v1.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/1dee3df8d29f4225c582eee2ddb6053ca616c0df\"\u003e\u003ccode\u003e1dee3df\u003c/code\u003e\u003c/a\u003e Update agent to v1.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/a5ad31d6a139d249332a2605b85202e8c0b78450\"\u003e\u003ccode\u003ea5ad31d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/657\"\u003e#657\u003c/a\u003e from devantler/fix/ubuntu-slim-user-env\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/6e928567d74554b8842dd434908da31c593ba85c\"\u003e\u003ccode\u003e6e92856\u003c/code\u003e\u003c/a\u003e build dist and trim ubuntu-slim message\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/4e0504ee086374bdec7064e5c26d48af41ba6209\"\u003e\u003ccode\u003e4e0504e\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into fix/ubuntu-slim-user-env\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/376d25a97f3a1640ff8cbbddaa4af25948df2cf3\"\u003e\u003ccode\u003e376d25a\u003c/code\u003e\u003c/a\u003e fix: detect ubuntu-slim runners early and bail out\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/step-security/harden-runner/compare/8d3c67de8e2fe68ef647c8db1e6a09f647780f40...9af89fc71515a100421586dfdb3dc9c984fbf411\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `golangci/golangci-lint-action` from 9.2.0 to 9.2.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/golangci/golangci-lint-action/releases\"\u003egolangci/golangci-lint-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev9.2.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eIMPORTANT: this is the first immutable release.\u003c/p\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003echore: improve workflows by \u003ca href=\"https://github.com/ldez\"\u003e\u003ccode\u003e@​ldez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1394\"\u003egolangci/golangci-lint-action#1394\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependencies\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1325\"\u003egolangci/golangci-lint-action#1325\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1326\"\u003egolangci/golangci-lint-action#1326\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump the dependencies group with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1327\"\u003egolangci/golangci-lint-action#1327\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1328\"\u003egolangci/golangci-lint-action#1328\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 25.0.2 to 25.0.3 in the dependencies group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1329\"\u003egolangci/golangci-lint-action#1329\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1330\"\u003egolangci/golangci-lint-action#1330\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1332\"\u003egolangci/golangci-lint-action#1332\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1333\"\u003egolangci/golangci-lint-action#1333\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump the dependencies group with 6 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1334\"\u003egolangci/golangci-lint-action#1334\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1335\"\u003egolangci/golangci-lint-action#1335\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump the dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1336\"\u003egolangci/golangci-lint-action#1336\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1337\"\u003egolangci/golangci-lint-action#1337\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 25.0.9 to 25.0.10 in the dependencies group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1338\"\u003egolangci/golangci-lint-action#1338\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.3.3 to 5.3.4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1339\"\u003egolangci/golangci-lint-action#1339\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1340\"\u003egolangci/golangci-lint-action#1340\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1344\"\u003egolangci/golangci-lint-action#1344\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.3.4 to 5.3.6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1346\"\u003egolangci/golangci-lint-action#1346\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump minimatch by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1348\"\u003egolangci/golangci-lint-action#1348\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump minimatch from 3.1.3 to 3.1.5 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1350\"\u003egolangci/golangci-lint-action#1350\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.3.6 to 5.4.1 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1351\"\u003egolangci/golangci-lint-action#1351\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.4.1 to 5.5.6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1357\"\u003egolangci/golangci-lint-action#1357\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.5.6 to 5.5.7 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1358\"\u003egolangci/golangci-lint-action#1358\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump flatted from 3.3.3 to 3.4.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1359\"\u003egolangci/golangci-lint-action#1359\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump picomatch from 4.0.3 to 4.0.4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1364\"\u003egolangci/golangci-lint-action#1364\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump yaml from 2.8.2 to 2.8.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1365\"\u003egolangci/golangci-lint-action#1365\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump brace-expansion by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1370\"\u003egolangci/golangci-lint-action#1370\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates by \u003ca href=\"https://github.com/ldez\"\u003e\u003ccode\u003e@​ldez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1374\"\u003egolangci/golangci-lint-action#1374\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 4 to 4.35.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1384\"\u003egolangci/golangci-lint-action#1384\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-builder from 1.1.5 to 1.2.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1386\"\u003egolangci/golangci-lint-action#1386\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1389\"\u003egolangci/golangci-lint-action#1389\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1391\"\u003egolangci/golangci-lint-action#1391\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/golangci/golangci-lint-action/compare/v9.2.0...v9.2.1\"\u003ehttps://github.com/golangci/golangci-lint-action/compare/v9.2.0...v9.2.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/82606bf257cbaff209d206a39f5134f0cfbfd2ee\"\u003e\u003ccode\u003e82606bf\u003c/code\u003e\u003c/a\u003e chore: prepare release v9.2.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/97c8387e660fa3be78f698fb592523e1f906a02c\"\u003e\u003ccode\u003e97c8387\u003c/code\u003e\u003c/a\u003e chore: improve workflows (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1394\"\u003e#1394\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/28d0a191bb76f633872d1f12600dd9900ac73840\"\u003e\u003ccode\u003e28d0a19\u003c/code\u003e\u003c/a\u003e build(deps): bump the dependencies group across 1 directory with 2 updates\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/633fbc7d54a1fe7d54f72fb83194a7d442beb929\"\u003e\u003ccode\u003e633fbc7\u003c/code\u003e\u003c/a\u003e build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1391\"\u003e#1391\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/59f43e26c902dadac745307f8cf2537da50ad344\"\u003e\u003ccode\u003e59f43e2\u003c/code\u003e\u003c/a\u003e build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1389\"\u003e#1389\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/9eb174e04acac69b4b7f6602f9a5cc384ba59b45\"\u003e\u003ccode\u003e9eb174e\u003c/code\u003e\u003c/a\u003e build(deps): bump fast-xml-builder from 1.1.5 to 1.2.0 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1386\"\u003e#1386\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/4f52504dfb47d09a983372e869f643e9e0d4014b\"\u003e\u003ccode\u003e4f52504\u003c/code\u003e\u003c/a\u003e build(deps): bump github/codeql-action from 4 to 4.35.2 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1384\"\u003e#1384\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/6f87dfdbd16618b59a5d86104adea6216152a47c\"\u003e\u003ccode\u003e6f87dfd\u003c/code\u003e\u003c/a\u003e docs: update examples\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/c9500d7aa7797b3e999034a3e6a0b9a4f18e8708\"\u003e\u003ccode\u003ec9500d7\u003c/code\u003e\u003c/a\u003e chore: improve workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/03b1faa37ed78712fa70fc44b56fa553f0d7a6bc\"\u003e\u003ccode\u003e03b1faa\u003c/code\u003e\u003c/a\u003e chore: improve issue templates\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/golangci/golangci-lint-action/compare/1e7e51e771db61008b38414a730f564565cf7c20...82606bf257cbaff209d206a39f5134f0cfbfd2ee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `codecov/codecov-action` from 6.0.0 to 6.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/codecov/codecov-action/releases\"\u003ecodecov/codecov-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: prevent template injection in run: steps (VULN-1652) by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1947\"\u003ecodecov/codecov-action#1947\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(release): 6.0.1 by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1949\"\u003ecodecov/codecov-action#1949\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1\"\u003ehttps://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md\"\u003ecodecov/codecov-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.5.2\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.1\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: overwrite pr number on fork by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1871\"\u003ecodecov/codecov-action#1871\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump actions/checkout from 4.2.2 to 5.0.0 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1868\"\u003ecodecov/codecov-action#1868\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1867\"\u003ecodecov/codecov-action#1867\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update to use local app/ dir by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1872\"\u003ecodecov/codecov-action#1872\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: fix typo in README by \u003ca href=\"https://github.com/datalater\"\u003e\u003ccode\u003e@​datalater\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1866\"\u003ecodecov/codecov-action#1866\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument a \u003ccode\u003ecodecov-cli\u003c/code\u003e version reference example by \u003ca href=\"https://github.com/webknjaz\"\u003e\u003ccode\u003e@​webknjaz\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1774\"\u003ecodecov/codecov-action#1774\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1861\"\u003ecodecov/codecov-action#1861\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1833\"\u003ecodecov/codecov-action#1833\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.0\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efeat: upgrade wrapper to 0.2.4 by \u003ca href=\"https://github.com/jviall\"\u003e\u003ccode\u003e@​jviall\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1864\"\u003ecodecov/codecov-action#1864\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin actions/github-script by Git SHA by \u003ca href=\"https://github.com/martincostello\"\u003e\u003ccode\u003e@​martincostello\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1859\"\u003ecodecov/codecov-action#1859\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: check reqs exist by \u003ca href=\"https://github.com/joseph-sentry\"\u003e\u003ccode\u003e@​joseph-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1835\"\u003ecodecov/codecov-action#1835\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: Typo in README by \u003ca href=\"https://github.com/spalmurray\"\u003e\u003ccode\u003e@​spalmurray\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1838\"\u003ecodecov/codecov-action#1838\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: Refine OIDC docs by \u003ca href=\"https://github.com/spalmurray\"\u003e\u003ccode\u003e@​spalmurray\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1837\"\u003ecodecov/codecov-action#1837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1829\"\u003ecodecov/codecov-action#1829\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.3\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1822\"\u003ecodecov/codecov-action#1822\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: OIDC on forks by \u003ca href=\"https://github.com/joseph-sentry\"\u003e\u003ccode\u003e@​joseph-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1823\"\u003ecodecov/codecov-action#1823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/codecov/codecov-action/commit/e79a6962e0d4c0c17b229090214935d2e33f8354\"\u003e\u003ccode\u003ee79a696\u003c/code\u003e\u003c/a\u003e chore(release): 6.0.1 (\u003ca href=\"https://redirect.github.com/codecov/codecov-action/issues/1949\"\u003e#1949\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/codecov/codecov-action/commit/51e64229ac331acb0d7f7b17c67423995f991c79\"\u003e\u003ccode\u003e51e6422\u003c/code\u003e\u003c/a\u003e fix: prevent template injection in run: steps (VULN-1652) (\u003ca href=\"https://redirect.github.com/codecov/codecov-action/issues/1947\"\u003e#1947\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/codecov/codecov-action/compare/57e3a136b779b570ffcdbf80b3bdc90e7fab3de2...e79a6962e0d4c0c17b229090214935d2e33f8354\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/dependency-review-action` from 4.9.0 to 5.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/dependency-review-action/releases\"\u003eactions/dependency-review-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e5.0.0\u003c/h2\u003e\n\u003cp\u003eThis is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version \u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003ev2.327.1\u003c/a\u003e to run.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd .github/copilot-instructions.md for Copilot coding agent by \u003ca href=\"https://github.com/ahpook\"\u003e\u003ccode\u003e@​ahpook\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1067\"\u003eactions/dependency-review-action#1067\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate Node.js runtime from 20 to 24 by \u003ca href=\"https://github.com/scottschreckengaust\"\u003e\u003ccode\u003e@​scottschreckengaust\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1084\"\u003eactions/dependency-review-action#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump spdx-license-ids from 3.0.20 to 3.0.23 by \u003ca href=\"https://github.com/mongolyy\"\u003e\u003ccode\u003e@​mongolyy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1091\"\u003eactions/dependency-review-action#1091\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: bump actions/checkout from v4 to v6 in workflow examples by \u003ca href=\"https://github.com/Marukome0743\"\u003e\u003ccode\u003e@​Marukome0743\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1077\"\u003eactions/dependency-review-action#1077\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: patched version display for advisories with non-strict semver ranges (e.g. Maven beta versions) by \u003ca href=\"https://github.com/tspascoal\"\u003e\u003ccode\u003e@​tspascoal\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1076\"\u003eactions/dependency-review-action#1076\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolve security findings by \u003ca href=\"https://github.com/AshelyTC\"\u003e\u003ccode\u003e@​AshelyTC\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1094\"\u003eactions/dependency-review-action#1094\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ev5.0.0 release branch by \u003ca href=\"https://github.com/ahpook\"\u003e\u003ccode\u003e@​ahpook\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1098\"\u003eactions/dependency-review-action#1098\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scottschreckengaust\"\u003e\u003ccode\u003e@​scottschreckengaust\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1084\"\u003eactions/dependency-review-action#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mongolyy\"\u003e\u003ccode\u003e@​mongolyy\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1091\"\u003eactions/dependency-review-action#1091\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Marukome0743\"\u003e\u003ccode\u003e@​Marukome0743\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1077\"\u003eactions/dependency-review-action#1077\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/dependency-review-action/compare/v4.9.0...v5.0.0\"\u003ehttps://github.com/actions/dependency-review-action/compare/v4.9.0...v5.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/a1d282b36b6f3519aa1f3fc636f609c47dddb294\"\u003e\u003ccode\u003ea1d282b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1098\"\u003e#1098\u003c/a\u003e from actions/ahpook/v5-release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/eb6c199c5a85c7387f1f0b02b3ba5c6364740695\"\u003e\u003ccode\u003eeb6c199\u003c/code\u003e\u003c/a\u003e update examples to show \u003ca href=\"https://github.com/v5\"\u003e\u003ccode\u003e@​v5\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/3943c2c5beaaaf1806eb3758273c203dabcbf89c\"\u003e\u003ccode\u003e3943c2c\u003c/code\u003e\u003c/a\u003e v5.0.0 release branch\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/454943c880b147adbfe7de0cdd3ece1c00882033\"\u003e\u003ccode\u003e454943c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1094\"\u003e#1094\u003c/a\u003e from actions/ashelytc/security-findings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/6d92a1228e9e9db334f02c09f84fe9217d2b4463\"\u003e\u003ccode\u003e6d92a12\u003c/code\u003e\u003c/a\u003e revert \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e update\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/a8e5a7e93695b41abf6d1083cd220bee39a720f0\"\u003e\u003ccode\u003ea8e5a7e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1076\"\u003e#1076\u003c/a\u003e from tspascoal/fix-version-matching-for-non-string-s...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/b6b7079031ef4ed61656c221988f1f3bcbf35101\"\u003e\u003ccode\u003eb6b7079\u003c/code\u003e\u003c/a\u003e update \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e to 8.40.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/821a21dd691f162c4c5c2e9754a344accde9a208\"\u003e\u003ccode\u003e821a21d\u003c/code\u003e\u003c/a\u003e update more dependencies\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/05aaaae45cf4c420de012addf2a72e3435ddaa63\"\u003e\u003ccode\u003e05aaaae\u003c/code\u003e\u003c/a\u003e run npm audit fix\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/55d3e754501fc13c84b95637ce51f135012d41ea\"\u003e\u003ccode\u003e55d3e75\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1077\"\u003e#1077\u003c/a\u003e from Marukome0743/docs/checkout\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/dependency-review-action/compare/2031cfc080254a8a887f58cffee85186f0e49e48...a1d282b36b6f3519aa1f3fc636f609c47dddb294\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `goreleaser/goreleaser-action` from 7.2.1 to 7.2.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/goreleaser/goreleaser-action/releases\"\u003egoreleaser/goreleaser-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.2.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eci(deps): bump the actions group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/560\"\u003egoreleaser/goreleaser-action#560\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: nightly resolution to select newest published release by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/562\"\u003egoreleaser/goreleaser-action#562\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/562\"\u003egoreleaser/goreleaser-action#562\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/v7...v7.2.2\"\u003ehttps://github.com/goreleaser/goreleaser-action/compare/v7...v7.2.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89\"\u003e\u003ccode\u003e5daf1e9\u003c/code\u003e\u003c/a\u003e fix: nightly resolution to select newest published release (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/562\"\u003e#562\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/5cc7ebb73d78b8f1d7b03c568e7df999c2889ccf\"\u003e\u003ccode\u003e5cc7ebb\u003c/code\u003e\u003c/a\u003e ci: update actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/702f5f91c9334614254ddeabeebaf820d707f0d6\"\u003e\u003ccode\u003e702f5f9\u003c/code\u003e\u003c/a\u003e ci(deps): bump the actions group with 3 updates (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/560\"\u003e#560\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8...5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/labeler` from 6.0.1 to 6.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/labeler/releases\"\u003eactions/labeler's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.1.0\u003c/h2\u003e\n\u003ch2\u003eEnhancements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd changed-files-labels-limit and max-files-changed configuration options to cap the number of labels added by \u003ca href=\"https://github.com/bluca\"\u003e\u003ccode\u003e@​bluca\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/923\"\u003eactions/labeler#923\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImprove Labeler Action documentation and permission error handling by \u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/897\"\u003eactions/labeler#897\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePreserve manually added labels during workflow runs and refine label synchronization logic by \u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/917\"\u003eactions/labeler#917\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDependency Updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/877\"\u003eactions/labeler#877\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade minimatch from 10.0.1 to 10.2.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/926\"\u003eactions/labeler#926\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade dependencies (\u003ccode\u003e@​actions/core\u003c/code\u003e, \u003ccode\u003e@​actions/github\u003c/code\u003e, js-yaml, minimatch, \u003ca href=\"https://github.com/typescript-eslint\"\u003e\u003ccode\u003e@​typescript-eslint\u003c/code\u003e\u003c/a\u003e) by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/934\"\u003eactions/labeler#934\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/897\"\u003eactions/labeler#897\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/bluca\"\u003e\u003ccode\u003e@​bluca\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/923\"\u003eactions/labeler#923\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/934\"\u003eactions/labeler#934\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/labeler/compare/v6...v6.1.0\"\u003ehttps://github.com/actions/labeler/compare/v6...v6.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/f27b608878404679385c85cfa523b85ccb86e213\"\u003e\u003ccode\u003ef27b608\u003c/code\u003e\u003c/a\u003e chore: upgrade dependencies (\u003ccode\u003e@​actions/core\u003c/code\u003e, \u003ccode\u003e@​actions/github\u003c/code\u003e, js-yaml, minimat...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/c5dadc2a45784a4b6adfcd20fea3465da3a5f904\"\u003e\u003ccode\u003ec5dadc2\u003c/code\u003e\u003c/a\u003e Add 'changed-files-labels-limit' and 'max-files-changed' configs to allow cap...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/e52e4fb63ed5cd0e07abaad9826b2a893ccb921f\"\u003e\u003ccode\u003ee52e4fb\u003c/code\u003e\u003c/a\u003e Bump minimatch from 10.0.1 to 10.2.3 (\u003ca href=\"https://redirect.github.com/actions/labeler/issues/926\"\u003e#926\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/77a4082b841706ac431479b7e2bb11216ffef250\"\u003e\u003ccode\u003e77a4082\u003c/code\u003e\u003c/a\u003e Fix: Preserve manually added labels during workflow run and refine label sync...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/25abb3cad4f14b7ac27968a495c37798860a5a1a\"\u003e\u003ccode\u003e25abb3c\u003c/code\u003e\u003c/a\u003e Improve Labeler Action Documentation and Error Handling for Permissions (\u003ca href=\"https://redirect.github.com/actions/labeler/issues/897\"\u003e#897\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/395c8cfdb1e1e691cc4bad0dd315820af8eb67fd\"\u003e\u003ccode\u003e395c8cf\u003c/code\u003e\u003c/a\u003e Bump brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v...\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/labeler/compare/634933edcd8ababfe52f92936142cc22ac488b1b...f27b608878404679385c85cfa523b85ccb86e213\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action` from 2.3.5 to 2.3.8\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9517144e5504957104c831530fe605bfdc71f353\"\u003e\u003ccode\u003e9517144\u003c/code\u003e\u003c/a\u003e feat: output results in reusable workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f17cd09224d6ef8be953fb49371e6bffb2dbf44a\"\u003e\u003ccode\u003ef17cd09\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into main\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/c51854704019a247608d928f370c98740469d4b5...9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `release-drafter/release-drafter` from 7.2.1 to 7.3.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/release-drafter/release-drafter/releases\"\u003erelease-drafter/release-drafter's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.3.1\u003c/h2\u003e\n\u003ch1\u003eWhat's Changed\u003c/h1\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: output name and tag_name in dry-run mode (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1625\"\u003e#1625\u003c/a\u003e) \u003ca href=\"https://github.com/cchanche\"\u003e\u003ccode\u003e@​cchanche\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eMaintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): update graphql-codegen to 7.0.0 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1619\"\u003e#1619\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency nock to 14.0.15 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1609\"\u003e#1609\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update graphql-codegen (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1615\"\u003e#1615\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency typescript to 6.0.3 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1610\"\u003e#1610\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci(deps): update actions/download-artifact action to v8.0.1 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1620\"\u003e#1620\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency \u003ccode\u003e@​types/node\u003c/code\u003e to 24.12.3 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1608\"\u003e#1608\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update vitest to 4.1.5 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1612\"\u003e#1612\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency \u003ccode\u003e@​biomejs/biome\u003c/code\u003e to 2.4.15 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1607\"\u003e#1607\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency vite to 8.0.11 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1611\"\u003e#1611\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci(deps): pin dependencies (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1606\"\u003e#1606\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDependency Updates\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): update node.js to v24.15.0 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1616\"\u003e#1616\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update vite to v8.0.13 and vitest to v4.1.6 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1624\"\u003e#1624\u003c/a\u003e) \u003ca href=\"https://github.com/cchanche\"\u003e\u003ccode\u003e@​cchanche\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(deps): update dependency semver to 7.8.0 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1622\"\u003e#1622\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update npm tool constraint to 11.14.1 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1617\"\u003e#1617\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(deps): update dependency zod to 4.4.3 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1618\"\u003e#1618\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(deps): update actions (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1613\"\u003e#1613\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency \u003ccode\u003e@​biomejs/biome\u003c/code\u003e to 2.4.15 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1607\"\u003e#1607\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(deps): update dependency yaml to 2.8.4 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1614\"\u003e#1614\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/release-drafter/release-drafter/compare/v7.3.0...v7.3.1\"\u003ehttps://github.com/release-drafter/release-drafter/compare/v7.3.0...v7.3.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev7.3.0\u003c/h2\u003e\n\u003ch1\u003eWhat's Changed\u003c/h1\u003e\n\u003ch2\u003eNew\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: recover recently merged PRs missed by associated PRs lag (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1604\"\u003e#1604\u003c/a\u003e) \u003ca href=\"https://github.com/jetersen\"\u003e\u003ccode\u003e@​jetersen\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: switch release discovery to ref comparison and explicit missing-baseline warnings (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1570\"\u003e#1570\u003c/a\u003e) \u003ca href=\"https://github.com/jetersen\"\u003e\u003ccode\u003e@​jetersen\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: restore prerelease-identifier on first run when no prior releases exist (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1602\"\u003e#1602\u003c/a\u003e) \u003ca href=\"https://github.com/jrbeilke\"\u003e\u003ccode\u003e@​jrbeilke\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: prevent using commitish like refs/pull (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1598\"\u003e#1598\u003c/a\u003e) \u003ca href=\"https://github.com/cchanche\"\u003e\u003ccode\u003e@​cchanche\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/693d20e7c1ce1a81d3a41962f85914253b518449\"\u003e\u003ccode\u003e693d20e\u003c/code\u003e\u003c/a\u003e chore: release v7.3.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/8339e41baa2bbe599e9144446202a730b0b512dc\"\u003e\u003ccode\u003e8339e41\u003c/code\u003e\u003c/a\u003e docs: update contributing docs for release process\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/62d8da40388ce452db900d9dd413236c55d8527b\"\u003e\u003ccode\u003e62d8da4\u003c/code\u003e\u003c/a\u003e fix: output name and tag_name in dry-run mode (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1625\"\u003e#1625\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/2c6d3958ca8ff5559d1816902d569397e6e7cd40\"\u003e\u003ccode\u003e2c6d395\u003c/code\u003e\u003c/a\u003e chore(deps): update node.js to v24.15.0 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1616\"\u003e#1616\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/3b62240da12f1ebb0e312c0e333efb7c975c9f83\"\u003e\u003ccode\u003e3b62240\u003c/code\u003e\u003c/a\u003e chore(deps): update vite to v8.0.13 and vitest to v4.1.6 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1624\"\u003e#1624\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/446e1517c52f0f2658eccfb62fe528f3c863e2ce\"\u003e\u003ccode\u003e446e151\u003c/code\u003e\u003c/a\u003e fix(deps): adapt to graphql-codegen 7 type changes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/4cd06dcb5f73b1a2c718f7902ca013a7b3ebffc1\"\u003e\u003ccode\u003e4cd06dc\u003c/code\u003e\u003c/a\u003e chore(deps): update graphql-codegen to 7.0.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/80457684ebeb5980a2523289611de1d198148dc0\"\u003e\u003ccode\u003e8045768\u003c/code\u003e\u003c/a\u003e fix(deps): update dependency semver to 7.8.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/1cf836b3aa269940ddd548267ab0a35726568d79\"\u003e\u003ccode\u003e1cf836b\u003c/code\u003e\u003c/a\u003e ci(release): use local action for publish step\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/485c120935331ce9b7d39543ad7441a80d6c7194\"\u003e\u003ccode\u003e485c120\u003c/code\u003e\u003c/a\u003e chore(deps): update npm tool constraint to 11.14.1\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/release-drafter/release-drafter/compare/563bf132657a13ded0b01fcb723c5a58cdd824e2...693d20e7c1ce1a81d3a41962f85914253b518449\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `sigstore/cosign-installer` from 4.1.1 to 4.1.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/sigstore/cosign-installer/releases\"\u003esigstore/cosign-installer's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.1.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump cosign to 3.0.6 in \u003ca href=\"https://redirect.github.com/sigstore/cosign-installer/pull/232\"\u003esigstore/cosign-installer#232\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sigstore/cosign-installer/commit/6f9f17788090df1f26f669e9d70d6ae9567deba6\"\u003e\u003ccode\u003e6f9f177\u003c/code\u003e\u003c/a\u003e Bump cosign to 3.0.6 (\u003ca href=\"https://redirect.github.com/sigstore/cosign-installer/issues/232\"\u003e#232\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sigstore/cosign-installer/commit/b5e753ae2d39589c7b38850b463739151fc67f07\"\u003e\u003ccode\u003eb5e753a\u003c/code\u003e\u003c/a\u003e Bump actions/github-script from 8.0.0 to 9.0.0 (\u003ca href=\"https://redirect.github.com/sigstore/cosign-installer/issues/230\"\u003e#230\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sigstore/cosign-installer/commit/115e4ce455e573aa6e9ba51e8d040ddd5c1378af\"\u003e\u003ccode\u003e115e4ce\u003c/code\u003e\u003c/a\u003e Bump actions/setup-go from 6.3.0 to 6.4.0 (\u003ca href=\"https://redirect.github.com/sigstore/cosign-installer/issues/226\"\u003e#226\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/sigstore/cosign-installer/compare/cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003...6f9f17788090df1f26f669e9d70d6ae9567deba6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `docker/setup-buildx-action` from 4.0.0 to 4.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/docker/setup-buildx-action/releases\"\u003edocker/setup-buildx-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.1.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.79.0 to 0.90.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/489\"\u003edocker/setup-buildx-action#489\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump brace-expansion from 1.1.12 to 5.0.6 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/547\"\u003edocker/setup-buildx-action#547\u003c/a\u003e \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/508\"\u003edocker/setup-buildx-action#508\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump fast-xml-builder from 1.0.0 to 1.2.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/540\"\u003edocker/setup-buildx-action#540\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump fast-xml-parser from 5.4.2 to 5.8.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/496\"\u003edocker/setup-buildx-action#496\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.3 to 3.4.2 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/499\"\u003edocker/setup-buildx-action#499\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump glob from 10.3.12 to 13.0.6 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/495\"\u003edocker/setup-buildx-action#495\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump handlebars from 4.7.8 to 4.7.9 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/504\"\u003edocker/setup-buildx-action#504\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump lodash from 4.17.23 to 4.18.1 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/523\"\u003edocker/setup-buildx-action#523\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump picomatch from 4.0.3 to 4.0.4 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/503\"\u003edocker/setup-buildx-action#503\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump postcss from 8.5.6 to 8.5.10 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/537\"\u003edocker/setup-buildx-action#537\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump tar from 6.2.1 to 7.5.15 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/545\"\u003edocker/setup-buildx-action#545\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 6.23.0 to 6.25.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/492\"\u003edocker/setup-buildx-action#492\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump vite from 7.3.1 to 7.3.2 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/520\"\u003edocker/setup-buildx-action#520\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/v4.0.0...v4.1.0\"\u003ehttps://github.com/docker/setup-buildx-action/compare/v4.0.0...v4.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5\"\u003e\u003ccode\u003ed7f5e7f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/489\"\u003e#489\u003c/a\u003e from docker/dependabot/npm_and_yarn/docker/actions-to...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/92bc5c9777806d0a73d9d668ba2114fa1177f164\"\u003e\u003ccode\u003e92bc5c9\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/da11e35abee0f20cb4f1c1b7c461d37c29be52f5\"\u003e\u003ccode\u003eda11e35\u003c/code\u003e\u003c/a\u003e build(deps): bump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.79.0 to 0.90.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/f021e162ef95b6fba51af1c6674f537f25bce851\"\u003e\u003ccode\u003ef021e16\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/492\"\u003e#492\u003c/a\u003e from docker/dependabot/npm_and_yarn/undici-6.24.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/b5af94fab700aee0c64d6077e0e34ae987815b67\"\u003e\u003ccode\u003eb5af94f\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/16ad9776a801d0c47f0a05f007b88a3789aa8ab6\"\u003e\u003ccode\u003e16ad977\u003c/code\u003e\u003c/a\u003e build(deps): bump undici from 6.23.0 to 6.25.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/d7a12d7df895b33bd02a9b4bf62a12f2b9a24458\"\u003e\u003ccode\u003ed7a12d7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/495\"\u003e#495\u003c/a\u003e from docker/dependabot/npm_and_yarn/glob-10.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/28ff27de4eed7518d361591f2cd1dfb69c34a7cb\"\u003e\u003ccode\u003e28ff27d\u003c/code\u003e\u003c/a\u003e build(deps): bump glob from 10.3.12 to 13.0.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/daf436b50e13d9053b9730cbc16516891878b019\"\u003e\u003ccode\u003edaf436b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/496\"\u003e#496\u003c/a\u003e from docker/dependabot/npm_and_yarn/fast-xml-parser-5...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/9725348367859764880f2f2e688a6b0c353e3f35\"\u003e\u003ccode\u003e9725348\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd...d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `docker/login-action` from 4.1.0 to 4.2.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/docker/login-action/releases\"\u003edocker/login-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.2.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e from 3.0.0 to 3.0.1 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/976\"\u003edocker/login-action#976\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​aws-sdk/client-ecr\u003c/code\u003e and \u003ccode\u003e@​aws-sdk/client-ecr-public\u003c/code\u003e to 3.1050.0 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/960\"\u003edocker/login-action#960\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.86.0 to 0.90.0 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/970\"\u003edocker/login-action#970\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump brace-expansion from 2.0.1 to 5.0.6 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/993\"\u003edocker/login-action#993\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump fast-xml-builder from 1.1.4 to 1.2.0 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/985\"\u003edocker/login-action#985\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump fast-xml-parser from 5.3.6 to 5.8.0 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/963\"\u003edocker/login-action#963\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump http-proxy-agent and https-proxy-agent to 9.0.0 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/961\"\u003edocker/login-action#961\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump postcss from 8.5.6 to 8.5.10 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/979\"\u003edocker/login-action#979\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump tar from 6.2.1 to 7.5.15 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/991\"\u003edocker/login-action#991\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump vite from 7.3.1 to 7.3.3 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/986\"\u003edocker/login-action#986\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/login-action/compare/v4.1.0...v4.2.0\"\u003ehttps://github.com/docker/login-action/compare/v4.1.0...v4.2.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/650006c6eb7dba73a995cc03b0b2d7f5ca915bee\"\u003e\u003ccode\u003e650006c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/login-action/issues/960\"\u003e#960\u003c/a\u003e from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/99df1a3f6d65e48177ea57671a50e2242eae4b63\"\u003e\u003ccode\u003e99df1a3\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/3ab375f324f46da5f6901efeda4be4e2566ebaa2\"\u003e\u003ccode\u003e3ab375f\u003c/code\u003e\u003c/a\u003e build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/39d85804ae465a1816c68ff58158ec66883981b4\"\u003e\u003ccode\u003e39d8580\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/login-action/issues/970\"\u003e#970\u003c/a\u003e from docker/dependabot/npm_and_yarn/docker/actions-to...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/4eefcd33ca7213989697445a78b6730274bfaba6\"\u003e\u003ccode\u003e4eefcd3\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/56d092c8b3f04006c22f4fc20a2b3d2442caed56\"\u003e\u003ccode\u003e56d092c\u003c/code\u003e\u003c/a\u003e build(deps): bump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.86.0 to 0.90.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/e2e31ca87063ae00fd41ad3b9c548dd8ec24c5ff\"\u003e\u003ccode\u003ee2e31ca\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/login-action/issues/976\"\u003e#976\u003c/a\u003e from docker/dependabot/npm_and_yarn/actions/core-3.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/0bced941e843afc786fbfd58b1c6c13ca11e09c9\"\u003e\u003ccode\u003e0bced94\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/3e75a0f266b07e09777a621d0ca5f4432ef9f10c\"\u003e\u003ccode\u003e3e75a0f\u003c/code\u003e\u003c/a\u003e build(deps): bump \u003ccode\u003e@​actions/core\u003c/code\u003e from 3.0.0 to 3.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/365bebd9d646160567ebad47824f026e09ee6970\"\u003e\u003ccode\u003e365bebd\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/login-action/issues/984\"\u003e#984\u003c/a\u003e from docker/dependabot/github_actions/aws-actions/con...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/docker/login-action/compare/4907a6ddec9925e35a0a9e82d7399ccc52663121...650006c6eb7dba73a995cc03b0b2d7f5ca915bee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `crate-ci/typos` from 1.45.2 to 1.46.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/crate-ci/typos/releases\"\u003ecrate-ci/typos's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.46.3\u003c/h2\u003e\n\u003ch2\u003e[1.46.3] - 2026-05-23\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003esequentials\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003esubdolder\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.46.2\u003c/h2\u003e\n\u003ch2\u003e[1.46.2] - 2026-05-16\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003ecriterias\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003ereplaceables\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.46.1\u003c/h2\u003e\n\u003ch2\u003e[1.46.1] - 2026-05-08\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003econfidentials\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.46.0\u003c/h2\u003e\n\u003ch2\u003e[1.46.0] - 2026-04-30\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated the dictionary with the \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1531\"\u003eApril 2026\u003c/a\u003e changes\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/crate-ci/typos/blob/master/CHANGELOG.md\"\u003ecrate-ci/typos's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChange Log\u003c/h1\u003e\n\u003cp\u003eAll notable changes to this project will be documented in this file.\u003c/p\u003e\n\u003cp\u003eThe format is based on \u003ca href=\"https://keepachangelog.com/\"\u003eKeep a Changelog\u003c/a\u003e\nand this project adheres to \u003ca href=\"https://semver.org/\"\u003eSemantic Versioning\u003c/a\u003e.\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003e[Unreleased] - ReleaseDate\u003c/h2\u003e\n\u003ch2\u003e[1.46.3] - 2026-05-23\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003esequentials\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003esubdolder\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.46.2] - 2026-05-16\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003ecriterias\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003ereplaceables\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.46.1] - 2026-05-08\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003econfidentials\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.46.0] - 2026-04-30\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated the dictionary with the \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1531\"\u003eApril 2026\u003c/a\u003e changes\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.45.2] - 2026-04-27\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eIgnore ssh ed25519 public keys\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.45.1] - 2026-04-13\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003e(action)\u003c/em\u003e Use a temp dir for caching\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.45.0] - 2026-04-01\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/7b04f660f4ee4f048d18fd341887cf28dfbedfe2\"\u003e\u003ccode\u003e7b04f66\u003c/code\u003e\u003c/a\u003e chore: Release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/6eefe9fe8912c8838f92bc036e3a6deb5980a5d6\"\u003e\u003ccode\u003e6eefe9f\u003c/code\u003e\u003c/a\u003e docs: Update changelog\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/27ae304665df6c1ed33363f179c1656fc03de0f1\"\u003e\u003ccode\u003e27ae304\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1559\"\u003e#1559\u003c/a\u003e from epage/fixes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/5b01f667d285db3c07f1f6f6e5915550d474e364\"\u003e\u003ccode\u003e5b01f66\u003c/code\u003e\u003c/a\u003e fix(dict): Don't correct to sequentials\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/4dbd644b8d3d4b8d25b0993b924bf84bfec4f8f8\"\u003e\u003ccode\u003e4dbd644\u003c/code\u003e\u003c/a\u003e fix(dict): Don't correct to subdolder\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/aca895bf05aec0cb7dffa6f94495e923224d9f17\"\u003e\u003ccode\u003eaca895b\u003c/code\u003e\u003c/a\u003e chore: Release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/4dbdd7509d345c6a2abf73bb722a2ae0126eec72\"\u003e\u003ccode\u003e4dbdd75\u003c/code\u003e\u003c/a\u003e docs: Update changelog\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/3da287673172dece00f174b38faa763e7cb294dc\"\u003e\u003ccode\u003e3da2876\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1556\"\u003e#1556\u003c/a\u003e from epage/replaceable\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/8918680477461d6cb133f4565eaa70f8237e27ae\"\u003e\u003ccode\u003e8918680\u003c/code\u003e\u003c/a\u003e fix(dict): Don't correct to replaceables\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/57d5422e87c3d28c9b9a61785ac5e8e0fcaae205\"\u003e\u003ccode\u003e57d5422\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1555\"\u003e#1555\u003c/a\u003e from epage/criteria\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/crate-ci/typos/compare/7c572958218557a3272c2d6719629443b5cc26fd...7b04f660f4ee4f048d18fd341887cf28dfbedfe2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cde...\n\n_Description has been truncated_","html_url":"https://github.com/afadesigns/zshellcheck/pull/1335","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/afadesigns%2Fzshellcheck/issues/1335","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/1335/packages"},{"uuid":"4506247754","node_id":"PR_kwDOSe3Vr87ehtnF","number":2,"state":"closed","title":"chore(deps): bump the github-actions group across 1 directory with 14 updates","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":"2026-05-30T01:01:37.000Z","author_association":null,"state_reason":null,"created_at":"2026-05-23T00:28:17.000Z","updated_at":"2026-05-30T01:01:39.000Z","time_to_close":606800,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"github-actions","update_count":14,"packages":[{"name":"actions/checkout","old_version":"3.1.0","new_version":"6.0.2","repository_url":"https://github.com/actions/checkout"},{"name":"step-security/harden-runner","old_version":"2.19.0","new_version":"2.19.4","repository_url":"https://github.com/step-security/harden-runner"},{"name":"golangci/golangci-lint-action","old_version":"9.2.0","new_version":"9.2.1","repository_url":"https://github.com/golangci/golangci-lint-action"},{"name":"codecov/codecov-action","old_version":"6.0.0","new_version":"6.0.1","repository_url":"https://github.com/codecov/codecov-action"},{"name":"github/codeql-action","old_version":"2.1.36","new_version":"4.36.0","repository_url":"https://github.com/github/codeql-action"},{"name":"actions/dependency-review-action","old_version":"4.9.0","new_version":"5.0.0","repository_url":"https://github.com/actions/dependency-review-action"},{"name":"goreleaser/goreleaser-action","old_version":"7.2.1","new_version":"7.2.2","repository_url":"https://github.com/goreleaser/goreleaser-action"},{"name":"actions/labeler","old_version":"6.0.1","new_version":"6.1.0","repository_url":"https://github.com/actions/labeler"},{"name":"google/osv-scanner-action","old_version":"2.3.5","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"release-drafter/release-drafter","old_version":"7.2.1","new_version":"7.3.0","repository_url":"https://github.com/release-drafter/release-drafter"},{"name":"sigstore/cosign-installer","old_version":"4.1.1","new_version":"4.1.2","repository_url":"https://github.com/sigstore/cosign-installer"},{"name":"docker/setup-buildx-action","old_version":"4.0.0","new_version":"4.1.0","repository_url":"https://github.com/docker/setup-buildx-action"},{"name":"docker/login-action","old_version":"4.1.0","new_version":"4.2.0","repository_url":"https://github.com/docker/login-action"},{"name":"crate-ci/typos","old_version":"1.45.2","new_version":"1.46.2","repository_url":"https://github.com/crate-ci/typos"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions group with 14 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/checkout](https://github.com/actions/checkout) | `3.1.0` | `6.0.2` |\n| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.19.0` | `2.19.4` |\n| [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `9.2.0` | `9.2.1` |\n| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `6.0.0` | `6.0.1` |\n| [github/codeql-action](https://github.com/github/codeql-action) | `2.1.36` | `4.36.0` |\n| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.9.0` | `5.0.0` |\n| [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `7.2.1` | `7.2.2` |\n| [actions/labeler](https://github.com/actions/labeler) | `6.0.1` | `6.1.0` |\n| [google/osv-scanner-action](https://github.com/google/osv-scanner-action) | `2.3.5` | `2.3.8` |\n| [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) | `7.2.1` | `7.3.0` |\n| [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `4.1.1` | `4.1.2` |\n| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.0.0` | `4.1.0` |\n| [docker/login-action](https://github.com/docker/login-action) | `4.1.0` | `4.2.0` |\n| [crate-ci/typos](https://github.com/crate-ci/typos) | `1.45.2` | `1.46.2` |\n\n\nUpdates `actions/checkout` from 3.1.0 to 6.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/releases\"\u003eactions/checkout's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by \u003ca href=\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2355\"\u003eactions/checkout#2355\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6.0.1...v6.0.2\"\u003ehttps://github.com/actions/checkout/compare/v6.0.1...v6.0.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all references from v5 and v4 to v6 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2314\"\u003eactions/checkout#2314\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eClarify v6 README by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2328\"\u003eactions/checkout#2328\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6...v6.0.1\"\u003ehttps://github.com/actions/checkout/compare/v6...v6.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ev6-beta by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2298\"\u003eactions/checkout#2298\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate readme/changelog for v6 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2311\"\u003eactions/checkout#2311\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v5.0.0...v6.0.0\"\u003ehttps://github.com/actions/checkout/compare/v5.0.0...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6-beta\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eUpdated persist-credentials to store the credentials under \u003ccode\u003e$RUNNER_TEMP\u003c/code\u003e instead of directly in the local git config.\u003c/p\u003e\n\u003cp\u003eThis requires a minimum Actions Runner version of \u003ca href=\"https://github.com/actions/runner/releases/tag/v2.329.0\"\u003ev2.329.0\u003c/a\u003e to access the persisted credentials for \u003ca href=\"https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action\"\u003eDocker container action\u003c/a\u003e scenarios.\u003c/p\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v5...v5.0.1\"\u003ehttps://github.com/actions/checkout/compare/v5...v5.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare v5.0.0 release by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2238\"\u003eactions/checkout#2238\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e⚠️ Minimum Compatible Runner Version\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003ev2.327.1\u003c/strong\u003e\u003cbr /\u003e\n\u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003eRelease Notes\u003c/a\u003e\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\"\u003eactions/checkout's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v4 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2305\"\u003eactions/checkout#2305\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update README.md by \u003ca href=\"https://github.com/motss\"\u003e\u003ccode\u003e@​motss\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1971\"\u003eactions/checkout#1971\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd internal repos for checking out multiple repositories by \u003ca href=\"https://github.com/mouismail\"\u003e\u003ccode\u003e@​mouismail\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1977\"\u003eactions/checkout#1977\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation update - add recommended permissions to Readme by \u003ca href=\"https://github.com/benwells\"\u003e\u003ccode\u003e@​benwells\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2043\"\u003eactions/checkout#2043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdjust positioning of user email note and permissions heading by \u003ca href=\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2044\"\u003eactions/checkout#2044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca href=\"https://github.com/nebuk89\"\u003e\u003ccode\u003e@​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2194\"\u003eactions/checkout#2194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate CODEOWNERS for actions by \u003ca href=\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2224\"\u003eactions/checkout#2224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate package dependencies by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2236\"\u003eactions/checkout#2236\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eurl-helper.ts\u003c/code\u003e now leverages well-known environment variables by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1941\"\u003eactions/checkout#1941\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpand unit test coverage for \u003ccode\u003eisGhes\u003c/code\u003e by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1946\"\u003eactions/checkout#1946\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck out other refs/* by commit if provided, fall back to ref by \u003ca href=\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1924\"\u003eactions/checkout#1924\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd Ref and Commit outputs by \u003ca href=\"https://github.com/lucacome\"\u003e\u003ccode\u003e@​lucacome\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1180\"\u003eactions/checkout#1180\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDependency updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e- \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1777\"\u003eactions/checkout#1777\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1872\"\u003eactions/checkout#1872\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.1.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1739\"\u003eactions/checkout#1739\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 3 to 4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1697\"\u003eactions/checkout#1697\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCheck out other refs/* by commit by \u003ca href=\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1774\"\u003eactions/checkout#1774\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin actions/checkout's own workflows to a known, good, stable version. by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1776\"\u003eactions/checkout#1776\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.1.6\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck platform to set archive extension appropriately by \u003ca href=\"https://github.com/cory-miller\"\u003e\u003ccode\u003e@​cory-miller\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1732\"\u003eactions/checkout#1732\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/de0fac2e4500dabe0009e67214ff5f5447ce83dd\"\u003e\u003ccode\u003ede0fac2\u003c/code\u003e\u003c/a\u003e Fix tag handling: preserve annotations and explicit fetch-tags (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2356\"\u003e#2356\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/064fe7f3312418007dea2b49a19844a9ee378f49\"\u003e\u003ccode\u003e064fe7f\u003c/code\u003e\u003c/a\u003e Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/8e8c483db84b4bee98b60c0593521ed34d9990e8\"\u003e\u003ccode\u003e8e8c483\u003c/code\u003e\u003c/a\u003e Clarify v6 README (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2328\"\u003e#2328\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/033fa0dc0b82693d8986f1016a0ec2c5e7d9cbb1\"\u003e\u003ccode\u003e033fa0d\u003c/code\u003e\u003c/a\u003e Add worktree support for persist-credentials includeIf (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2327\"\u003e#2327\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5\"\u003e\u003ccode\u003ec2d88d3\u003c/code\u003e\u003c/a\u003e Update all references from v5 and v4 to v6 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2314\"\u003e#2314\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3\"\u003e\u003ccode\u003e1af3b93\u003c/code\u003e\u003c/a\u003e update readme/changelog for v6 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2311\"\u003e#2311\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/71cf2267d89c5cb81562390fa70a37fa40b1305e\"\u003e\u003ccode\u003e71cf226\u003c/code\u003e\u003c/a\u003e v6-beta (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2298\"\u003e#2298\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/069c6959146423d11cd0184e6accf28f9d45f06e\"\u003e\u003ccode\u003e069c695\u003c/code\u003e\u003c/a\u003e Persist creds to a separate file (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2286\"\u003e#2286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493\"\u003e\u003ccode\u003eff7abcd\u003c/code\u003e\u003c/a\u003e Update README to include Node.js 24 support details and requirements (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2248\"\u003e#2248\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/08c6903cd8c0fde910a37f88322edcfb5dd907a8\"\u003e\u003ccode\u003e08c6903\u003c/code\u003e\u003c/a\u003e Prepare v5.0.0 release (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2238\"\u003e#2238\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/checkout/compare/v3.1.0...de0fac2e4500dabe0009e67214ff5f5447ce83dd\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `step-security/harden-runner` from 2.19.0 to 2.19.4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/step-security/harden-runner/releases\"\u003estep-security/harden-runner's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.19.4\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImprovements for HTTPS Monitoring for the Enterprise tier of Harden Runner\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.3...v2.19.4\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.3...v2.19.4\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.3\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDefault to audit mode when api-key missing with use-policy-store by \u003ca href=\"https://github.com/varunsh-coder\"\u003e\u003ccode\u003e@​varunsh-coder\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/665\"\u003estep-security/harden-runner#665\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: detect ubuntu-slim runners early and bail out by \u003ca href=\"https://github.com/devantler\"\u003e\u003ccode\u003e@​devantler\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/657\"\u003estep-security/harden-runner#657\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eWhat the fix changes\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eHarden-Runner will detect \u003ccode\u003eubuntu-slim\u003c/code\u003e runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eWhat the fix does not do\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eJobs running on \u003ccode\u003eubuntu-slim\u003c/code\u003e will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).\u003c/li\u003e\n\u003cli\u003ePer GitHub's docs on \u003ca href=\"https://docs.github.com/en/actions/reference/runners/github-hosted-runners#single-cpu-runners\"\u003esingle-CPU runners\u003c/a\u003e: \u0026quot;The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported.\u0026quot;  Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eFor StepSecurity enterprise customers\nIf your security posture requires that workflows are always monitored, you can block the use of \u003ccode\u003eubuntu-slim\u003c/code\u003e via workflow run policies see the \u003ca href=\"https://docs.stepsecurity.io/workflow-run-policies/policies#runner-label-policy\"\u003eRunner Label Policy\u003c/a\u003e docs. This lets you enforce that jobs only run on monitored runner types.\u003c/p\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/devantler\"\u003e\u003ccode\u003e@​devantler\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/657\"\u003estep-security/harden-runner#657\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/9af89fc71515a100421586dfdb3dc9c984fbf411\"\u003e\u003ccode\u003e9af89fc\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/667\"\u003e#667\u003c/a\u003e from step-security/update-agent-v1.8.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/485dce8cb5d75cda51e8bfa947de06030d080208\"\u003e\u003ccode\u003e485dce8\u003c/code\u003e\u003c/a\u003e Update agent to v1.8.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ab7a9404c0f3da075243ca237b5fac12c98deaa5\"\u003e\u003ccode\u003eab7a940\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/665\"\u003e#665\u003c/a\u003e from step-security/fix/use-policy-store-default-audit\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ec41b783c27ed7f0db6855a6d9970abd4572858c\"\u003e\u003ccode\u003eec41b78\u003c/code\u003e\u003c/a\u003e Default to audit mode when api-key missing with use-policy-store\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/9ca718d3bf646d6534007c269a635b3e54cadf99\"\u003e\u003ccode\u003e9ca718d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/664\"\u003e#664\u003c/a\u003e from step-security/update-agent-v1.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/1dee3df8d29f4225c582eee2ddb6053ca616c0df\"\u003e\u003ccode\u003e1dee3df\u003c/code\u003e\u003c/a\u003e Update agent to v1.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/a5ad31d6a139d249332a2605b85202e8c0b78450\"\u003e\u003ccode\u003ea5ad31d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/657\"\u003e#657\u003c/a\u003e from devantler/fix/ubuntu-slim-user-env\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/6e928567d74554b8842dd434908da31c593ba85c\"\u003e\u003ccode\u003e6e92856\u003c/code\u003e\u003c/a\u003e build dist and trim ubuntu-slim message\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/4e0504ee086374bdec7064e5c26d48af41ba6209\"\u003e\u003ccode\u003e4e0504e\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into fix/ubuntu-slim-user-env\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/376d25a97f3a1640ff8cbbddaa4af25948df2cf3\"\u003e\u003ccode\u003e376d25a\u003c/code\u003e\u003c/a\u003e fix: detect ubuntu-slim runners early and bail out\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/step-security/harden-runner/compare/8d3c67de8e2fe68ef647c8db1e6a09f647780f40...9af89fc71515a100421586dfdb3dc9c984fbf411\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `golangci/golangci-lint-action` from 9.2.0 to 9.2.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/golangci/golangci-lint-action/releases\"\u003egolangci/golangci-lint-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev9.2.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eIMPORTANT: this is the first immutable release.\u003c/p\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003echore: improve workflows by \u003ca href=\"https://github.com/ldez\"\u003e\u003ccode\u003e@​ldez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1394\"\u003egolangci/golangci-lint-action#1394\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependencies\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1325\"\u003egolangci/golangci-lint-action#1325\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1326\"\u003egolangci/golangci-lint-action#1326\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump the dependencies group with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1327\"\u003egolangci/golangci-lint-action#1327\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1328\"\u003egolangci/golangci-lint-action#1328\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 25.0.2 to 25.0.3 in the dependencies group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1329\"\u003egolangci/golangci-lint-action#1329\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1330\"\u003egolangci/golangci-lint-action#1330\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1332\"\u003egolangci/golangci-lint-action#1332\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1333\"\u003egolangci/golangci-lint-action#1333\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump the dependencies group with 6 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1334\"\u003egolangci/golangci-lint-action#1334\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1335\"\u003egolangci/golangci-lint-action#1335\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump the dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1336\"\u003egolangci/golangci-lint-action#1336\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1337\"\u003egolangci/golangci-lint-action#1337\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 25.0.9 to 25.0.10 in the dependencies group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1338\"\u003egolangci/golangci-lint-action#1338\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.3.3 to 5.3.4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1339\"\u003egolangci/golangci-lint-action#1339\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1340\"\u003egolangci/golangci-lint-action#1340\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1344\"\u003egolangci/golangci-lint-action#1344\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.3.4 to 5.3.6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1346\"\u003egolangci/golangci-lint-action#1346\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump minimatch by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1348\"\u003egolangci/golangci-lint-action#1348\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump minimatch from 3.1.3 to 3.1.5 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1350\"\u003egolangci/golangci-lint-action#1350\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.3.6 to 5.4.1 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1351\"\u003egolangci/golangci-lint-action#1351\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.4.1 to 5.5.6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1357\"\u003egolangci/golangci-lint-action#1357\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.5.6 to 5.5.7 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1358\"\u003egolangci/golangci-lint-action#1358\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump flatted from 3.3.3 to 3.4.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1359\"\u003egolangci/golangci-lint-action#1359\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump picomatch from 4.0.3 to 4.0.4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1364\"\u003egolangci/golangci-lint-action#1364\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump yaml from 2.8.2 to 2.8.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1365\"\u003egolangci/golangci-lint-action#1365\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump brace-expansion by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1370\"\u003egolangci/golangci-lint-action#1370\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates by \u003ca href=\"https://github.com/ldez\"\u003e\u003ccode\u003e@​ldez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1374\"\u003egolangci/golangci-lint-action#1374\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 4 to 4.35.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1384\"\u003egolangci/golangci-lint-action#1384\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-builder from 1.1.5 to 1.2.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1386\"\u003egolangci/golangci-lint-action#1386\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1389\"\u003egolangci/golangci-lint-action#1389\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1391\"\u003egolangci/golangci-lint-action#1391\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/golangci/golangci-lint-action/compare/v9.2.0...v9.2.1\"\u003ehttps://github.com/golangci/golangci-lint-action/compare/v9.2.0...v9.2.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/82606bf257cbaff209d206a39f5134f0cfbfd2ee\"\u003e\u003ccode\u003e82606bf\u003c/code\u003e\u003c/a\u003e chore: prepare release v9.2.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/97c8387e660fa3be78f698fb592523e1f906a02c\"\u003e\u003ccode\u003e97c8387\u003c/code\u003e\u003c/a\u003e chore: improve workflows (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1394\"\u003e#1394\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/28d0a191bb76f633872d1f12600dd9900ac73840\"\u003e\u003ccode\u003e28d0a19\u003c/code\u003e\u003c/a\u003e build(deps): bump the dependencies group across 1 directory with 2 updates\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/633fbc7d54a1fe7d54f72fb83194a7d442beb929\"\u003e\u003ccode\u003e633fbc7\u003c/code\u003e\u003c/a\u003e build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1391\"\u003e#1391\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/59f43e26c902dadac745307f8cf2537da50ad344\"\u003e\u003ccode\u003e59f43e2\u003c/code\u003e\u003c/a\u003e build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1389\"\u003e#1389\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/9eb174e04acac69b4b7f6602f9a5cc384ba59b45\"\u003e\u003ccode\u003e9eb174e\u003c/code\u003e\u003c/a\u003e build(deps): bump fast-xml-builder from 1.1.5 to 1.2.0 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1386\"\u003e#1386\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/4f52504dfb47d09a983372e869f643e9e0d4014b\"\u003e\u003ccode\u003e4f52504\u003c/code\u003e\u003c/a\u003e build(deps): bump github/codeql-action from 4 to 4.35.2 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1384\"\u003e#1384\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/6f87dfdbd16618b59a5d86104adea6216152a47c\"\u003e\u003ccode\u003e6f87dfd\u003c/code\u003e\u003c/a\u003e docs: update examples\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/c9500d7aa7797b3e999034a3e6a0b9a4f18e8708\"\u003e\u003ccode\u003ec9500d7\u003c/code\u003e\u003c/a\u003e chore: improve workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/03b1faa37ed78712fa70fc44b56fa553f0d7a6bc\"\u003e\u003ccode\u003e03b1faa\u003c/code\u003e\u003c/a\u003e chore: improve issue templates\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/golangci/golangci-lint-action/compare/1e7e51e771db61008b38414a730f564565cf7c20...82606bf257cbaff209d206a39f5134f0cfbfd2ee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `codecov/codecov-action` from 6.0.0 to 6.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/codecov/codecov-action/releases\"\u003ecodecov/codecov-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: prevent template injection in run: steps (VULN-1652) by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1947\"\u003ecodecov/codecov-action#1947\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(release): 6.0.1 by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1949\"\u003ecodecov/codecov-action#1949\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1\"\u003ehttps://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md\"\u003ecodecov/codecov-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.5.2\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.1\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: overwrite pr number on fork by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1871\"\u003ecodecov/codecov-action#1871\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump actions/checkout from 4.2.2 to 5.0.0 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1868\"\u003ecodecov/codecov-action#1868\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1867\"\u003ecodecov/codecov-action#1867\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update to use local app/ dir by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1872\"\u003ecodecov/codecov-action#1872\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: fix typo in README by \u003ca href=\"https://github.com/datalater\"\u003e\u003ccode\u003e@​datalater\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1866\"\u003ecodecov/codecov-action#1866\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument a \u003ccode\u003ecodecov-cli\u003c/code\u003e version reference example by \u003ca href=\"https://github.com/webknjaz\"\u003e\u003ccode\u003e@​webknjaz\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1774\"\u003ecodecov/codecov-action#1774\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1861\"\u003ecodecov/codecov-action#1861\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1833\"\u003ecodecov/codecov-action#1833\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.0\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efeat: upgrade wrapper to 0.2.4 by \u003ca href=\"https://github.com/jviall\"\u003e\u003ccode\u003e@​jviall\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1864\"\u003ecodecov/codecov-action#1864\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin actions/github-script by Git SHA by \u003ca href=\"https://github.com/martincostello\"\u003e\u003ccode\u003e@​martincostello\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1859\"\u003ecodecov/codecov-action#1859\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: check reqs exist by \u003ca href=\"https://github.com/joseph-sentry\"\u003e\u003ccode\u003e@​joseph-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1835\"\u003ecodecov/codecov-action#1835\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: Typo in README by \u003ca href=\"https://github.com/spalmurray\"\u003e\u003ccode\u003e@​spalmurray\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1838\"\u003ecodecov/codecov-action#1838\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: Refine OIDC docs by \u003ca href=\"https://github.com/spalmurray\"\u003e\u003ccode\u003e@​spalmurray\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1837\"\u003ecodecov/codecov-action#1837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1829\"\u003ecodecov/codecov-action#1829\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.3\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1822\"\u003ecodecov/codecov-action#1822\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: OIDC on forks by \u003ca href=\"https://github.com/joseph-sentry\"\u003e\u003ccode\u003e@​joseph-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1823\"\u003ecodecov/codecov-action#1823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/codecov/codecov-action/commit/e79a6962e0d4c0c17b229090214935d2e33f8354\"\u003e\u003ccode\u003ee79a696\u003c/code\u003e\u003c/a\u003e chore(release): 6.0.1 (\u003ca href=\"https://redirect.github.com/codecov/codecov-action/issues/1949\"\u003e#1949\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/codecov/codecov-action/commit/51e64229ac331acb0d7f7b17c67423995f991c79\"\u003e\u003ccode\u003e51e6422\u003c/code\u003e\u003c/a\u003e fix: prevent template injection in run: steps (VULN-1652) (\u003ca href=\"https://redirect.github.com/codecov/codecov-action/issues/1947\"\u003e#1947\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/codecov/codecov-action/compare/57e3a136b779b570ffcdbf80b3bdc90e7fab3de2...e79a6962e0d4c0c17b229090214935d2e33f8354\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action` from 2.1.36 to 4.36.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.36.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.19.4. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal \u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will be enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for GitHub-internal use only, and may change without notice at any time. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning analysis for a PR with \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP OIDC are now accepted. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBest-effort connection tests for private registries now use \u003ccode\u003eGET\u003c/code\u003e requests instead of \u003ccode\u003eHEAD\u003c/code\u003e for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3853\"\u003e#3853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3\"\u003e2.25.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3865\"\u003e#3865\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe undocumented TRAP cache cleanup feature that could be enabled using the \u003ccode\u003eCODEQL_ACTION_CLEANUP_TRAP_CACHES\u003c/code\u003e environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the \u003ccode\u003etrap-caching: false\u003c/code\u003e input to the \u003ccode\u003einit\u003c/code\u003e Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3795\"\u003e#3795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3789\"\u003e#3789\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePython analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3794\"\u003e#3794\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3807\"\u003e#3807\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2\"\u003e2.25.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3823\"\u003e#3823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix incorrect minimum required Git version for \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e: it should have been 2.36.0, not 2.11.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3781\"\u003e#3781\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReduced the minimum Git version required for \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e from 2.38.0 to 2.11.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3767\"\u003e#3767\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1\"\u003e2.25.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3773\"\u003e#3773\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.34.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDowngrade default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3\"\u003e2.24.3\u003c/a\u003e due to issues with a small percentage of Actions and JavaScript analyses. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3762\"\u003e#3762\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.34.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded an experimental change which disables TRAP caching when \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3569\"\u003e#3569\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eWe are rolling out improved incremental analysis to C/C++ analyses that use build mode \u003ccode\u003enone\u003c/code\u003e. We expect this rollout to be complete by the end of April 2026. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3584\"\u003e#3584\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0\"\u003e2.25.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3585\"\u003e#3585\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.33.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3562\"\u003e#3562\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eTo opt out of this change:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eRepositories owned by an organization:\u003c/strong\u003e Create a custom repository property with the name \u003ccode\u003egithub-codeql-file-coverage-on-prs\u003c/code\u003e and the type \u0026quot;True/false\u0026quot;, then set this property to \u003ccode\u003etrue\u003c/code\u003e in the repository's settings. For more information, see \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003eManaging custom properties for repositories in your organization\u003c/a\u003e. Alternatively, if you are using an advanced setup workflow, you can set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUser-owned repositories using default setup:\u003c/strong\u003e Switch to an advanced setup workflow and set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUser-owned repositories using advanced setup:\u003c/strong\u003e Set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7211b7c8077ea37d8641b6271f6a365a22a5fbfa\"\u003e\u003ccode\u003e7211b7c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3927\"\u003e#3927\u003c/a\u003e from github/update-v4.36.0-ebc2d9e2b\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7740f2fb21add1d46278215acea47540db22f022\"\u003e\u003ccode\u003e7740f2f\u003c/code\u003e\u003c/a\u003e Update changelog for v4.36.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ebc2d9e2bc247eec51bee8d4df806c4030eb0761\"\u003e\u003ccode\u003eebc2d9e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3926\"\u003e#3926\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.25.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d1f74b777c95c777bf4f42ce4b250bc916e745c7\"\u003e\u003ccode\u003ed1f74b7\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/2dc40cec39bdc63d3561d74fa6100cebb0418ff4\"\u003e\u003ccode\u003e2dc40ce\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.25.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/84498526a009a99c875e83ef4821a8ba52de7c22\"\u003e\u003ccode\u003e8449852\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3910\"\u003e#3910\u003c/a\u003e from github/henrymercer/repo-size-diff-check\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/72ac23c6d16b29fbe801e87e3439941558c53094\"\u003e\u003ccode\u003e72ac23c\u003c/code\u003e\u003c/a\u003e Update excluded required check list\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c5297a28a2c3e6a8062041b58858bd7117cebe37\"\u003e\u003ccode\u003ec5297a2\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3919\"\u003e#3919\u003c/a\u003e from github/henrymercer/workflow-concurrency\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8ffeae7d05bc1b914a009d197e64e4f5c9e14503\"\u003e\u003ccode\u003e8ffeae7\u003c/code\u003e\u003c/a\u003e CI: Automatically cancel non-generated workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/f3f52bf568dc44a1069faafa538caa6b1fec40c9\"\u003e\u003ccode\u003ef3f52bf\u003c/code\u003e\u003c/a\u003e Revert \u003ccode\u003egetErrorMessage\u003c/code\u003e import\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/v2.1.36...v4.36.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/dependency-review-action` from 4.9.0 to 5.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/dependency-review-action/releases\"\u003eactions/dependency-review-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e5.0.0\u003c/h2\u003e\n\u003cp\u003eThis is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version \u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003ev2.327.1\u003c/a\u003e to run.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd .github/copilot-instructions.md for Copilot coding agent by \u003ca href=\"https://github.com/ahpook\"\u003e\u003ccode\u003e@​ahpook\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1067\"\u003eactions/dependency-review-action#1067\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate Node.js runtime from 20 to 24 by \u003ca href=\"https://github.com/scottschreckengaust\"\u003e\u003ccode\u003e@​scottschreckengaust\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1084\"\u003eactions/dependency-review-action#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump spdx-license-ids from 3.0.20 to 3.0.23 by \u003ca href=\"https://github.com/mongolyy\"\u003e\u003ccode\u003e@​mongolyy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1091\"\u003eactions/dependency-review-action#1091\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: bump actions/checkout from v4 to v6 in workflow examples by \u003ca href=\"https://github.com/Marukome0743\"\u003e\u003ccode\u003e@​Marukome0743\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1077\"\u003eactions/dependency-review-action#1077\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: patched version display for advisories with non-strict semver ranges (e.g. Maven beta versions) by \u003ca href=\"https://github.com/tspascoal\"\u003e\u003ccode\u003e@​tspascoal\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1076\"\u003eactions/dependency-review-action#1076\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolve security findings by \u003ca href=\"https://github.com/AshelyTC\"\u003e\u003ccode\u003e@​AshelyTC\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1094\"\u003eactions/dependency-review-action#1094\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ev5.0.0 release branch by \u003ca href=\"https://github.com/ahpook\"\u003e\u003ccode\u003e@​ahpook\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1098\"\u003eactions/dependency-review-action#1098\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scottschreckengaust\"\u003e\u003ccode\u003e@​scottschreckengaust\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1084\"\u003eactions/dependency-review-action#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mongolyy\"\u003e\u003ccode\u003e@​mongolyy\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1091\"\u003eactions/dependency-review-action#1091\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Marukome0743\"\u003e\u003ccode\u003e@​Marukome0743\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1077\"\u003eactions/dependency-review-action#1077\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/dependency-review-action/compare/v4.9.0...v5.0.0\"\u003ehttps://github.com/actions/dependency-review-action/compare/v4.9.0...v5.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/a1d282b36b6f3519aa1f3fc636f609c47dddb294\"\u003e\u003ccode\u003ea1d282b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1098\"\u003e#1098\u003c/a\u003e from actions/ahpook/v5-release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/eb6c199c5a85c7387f1f0b02b3ba5c6364740695\"\u003e\u003ccode\u003eeb6c199\u003c/code\u003e\u003c/a\u003e update examples to show \u003ca href=\"https://github.com/v5\"\u003e\u003ccode\u003e@​v5\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/3943c2c5beaaaf1806eb3758273c203dabcbf89c\"\u003e\u003ccode\u003e3943c2c\u003c/code\u003e\u003c/a\u003e v5.0.0 release branch\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/454943c880b147adbfe7de0cdd3ece1c00882033\"\u003e\u003ccode\u003e454943c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1094\"\u003e#1094\u003c/a\u003e from actions/ashelytc/security-findings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/6d92a1228e9e9db334f02c09f84fe9217d2b4463\"\u003e\u003ccode\u003e6d92a12\u003c/code\u003e\u003c/a\u003e revert \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e update\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/a8e5a7e93695b41abf6d1083cd220bee39a720f0\"\u003e\u003ccode\u003ea8e5a7e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1076\"\u003e#1076\u003c/a\u003e from tspascoal/fix-version-matching-for-non-string-s...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/b6b7079031ef4ed61656c221988f1f3bcbf35101\"\u003e\u003ccode\u003eb6b7079\u003c/code\u003e\u003c/a\u003e update \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e to 8.40.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/821a21dd691f162c4c5c2e9754a344accde9a208\"\u003e\u003ccode\u003e821a21d\u003c/code\u003e\u003c/a\u003e update more dependencies\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/05aaaae45cf4c420de012addf2a72e3435ddaa63\"\u003e\u003ccode\u003e05aaaae\u003c/code\u003e\u003c/a\u003e run npm audit fix\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/55d3e754501fc13c84b95637ce51f135012d41ea\"\u003e\u003ccode\u003e55d3e75\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1077\"\u003e#1077\u003c/a\u003e from Marukome0743/docs/checkout\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/dependency-review-action/compare/2031cfc080254a8a887f58cffee85186f0e49e48...a1d282b36b6f3519aa1f3fc636f609c47dddb294\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `goreleaser/goreleaser-action` from 7.2.1 to 7.2.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/goreleaser/goreleaser-action/releases\"\u003egoreleaser/goreleaser-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.2.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eci(deps): bump the actions group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/560\"\u003egoreleaser/goreleaser-action#560\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: nightly resolution to select newest published release by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/562\"\u003egoreleaser/goreleaser-action#562\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/562\"\u003egoreleaser/goreleaser-action#562\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/v7...v7.2.2\"\u003ehttps://github.com/goreleaser/goreleaser-action/compare/v7...v7.2.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89\"\u003e\u003ccode\u003e5daf1e9\u003c/code\u003e\u003c/a\u003e fix: nightly resolution to select newest published release (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/562\"\u003e#562\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/5cc7ebb73d78b8f1d7b03c568e7df999c2889ccf\"\u003e\u003ccode\u003e5cc7ebb\u003c/code\u003e\u003c/a\u003e ci: update actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/702f5f91c9334614254ddeabeebaf820d707f0d6\"\u003e\u003ccode\u003e702f5f9\u003c/code\u003e\u003c/a\u003e ci(deps): bump the actions group with 3 updates (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/560\"\u003e#560\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8...5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/labeler` from 6.0.1 to 6.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/labeler/releases\"\u003eactions/labeler's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.1.0\u003c/h2\u003e\n\u003ch2\u003eEnhancements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd changed-files-labels-limit and max-files-changed configuration options to cap the number of labels added by \u003ca href=\"https://github.com/bluca\"\u003e\u003ccode\u003e@​bluca\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/923\"\u003eactions/labeler#923\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImprove Labeler Action documentation and permission error handling by \u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/897\"\u003eactions/labeler#897\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePreserve manually added labels during workflow runs and refine label synchronization logic by \u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/917\"\u003eactions/labeler#917\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDependency Updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/877\"\u003eactions/labeler#877\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade minimatch from 10.0.1 to 10.2.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/926\"\u003eactions/labeler#926\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade dependencies (\u003ccode\u003e@​actions/core\u003c/code\u003e, \u003ccode\u003e@​actions/github\u003c/code\u003e, js-yaml, minimatch, \u003ca href=\"https://github.com/typescript-eslint\"\u003e\u003ccode\u003e@​typescript-eslint\u003c/code\u003e\u003c/a\u003e) by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/934\"\u003eactions/labeler#934\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/897\"\u003eactions/labeler#897\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/bluca\"\u003e\u003ccode\u003e@​bluca\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/923\"\u003eactions/labeler#923\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/934\"\u003eactions/labeler#934\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/labeler/compare/v6...v6.1.0\"\u003ehttps://github.com/actions/labeler/compare/v6...v6.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/f27b608878404679385c85cfa523b85ccb86e213\"\u003e\u003ccode\u003ef27b608\u003c/code\u003e\u003c/a\u003e chore: upgrade dependencies (\u003ccode\u003e@​actions/core\u003c/code\u003e, \u003ccode\u003e@​actions/github\u003c/code\u003e, js-yaml, minimat...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/c5dadc2a45784a4b6adfcd20fea3465da3a5f904\"\u003e\u003ccode\u003ec5dadc2\u003c/code\u003e\u003c/a\u003e Add 'changed-files-labels-limit' and 'max-files-changed' configs to allow cap...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/e52e4fb63ed5cd0e07abaad9826b2a893ccb921f\"\u003e\u003ccode\u003ee52e4fb\u003c/code\u003e\u003c/a\u003e Bump minimatch from 10.0.1 to 10.2.3 (\u003ca href=\"https://redirect.github.com/actions/labeler/issues/926\"\u003e#926\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/77a4082b841706ac431479b7e2bb11216ffef250\"\u003e\u003ccode\u003e77a4082\u003c/code\u003e\u003c/a\u003e Fix: Preserve manually added labels during workflow run and refine label sync...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/25abb3cad4f14b7ac27968a495c37798860a5a1a\"\u003e\u003ccode\u003e25abb3c\u003c/code\u003e\u003c/a\u003e Improve Labeler Action Documentation and Error Handling for Permissions (\u003ca href=\"https://redirect.github.com/actions/labeler/issues/897\"\u003e#897\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/395c8cfdb1e1e691cc4bad0dd315820af8eb67fd\"\u003e\u003ccode\u003e395c8cf\u003c/code\u003e\u003c/a\u003e Bump brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v...\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/labeler/compare/634933edcd8ababfe52f92936142cc22ac488b1b...f27b608878404679385c85cfa523b85ccb86e213\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action` from 2.3.5 to 2.3.8\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9517144e5504957104c831530fe605bfdc71f353\"\u003e\u003ccode\u003e9517144\u003c/code\u003e\u003c/a\u003e feat: output results in reusab...\n\n_Description has been truncated_","html_url":"https://github.com/actions-marketplace-validations/afadesigns_zshellcheck/pull/2","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions-marketplace-validations%2Fafadesigns_zshellcheck/issues/2","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/2/packages"},{"uuid":"4466672747","node_id":"PR_kwDORqFcsM7chpJo","number":11,"state":"open","title":"Bump google/osv-scanner-action from 1.9.1 to 2.3.8","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-05-18T06:04:44.000Z","updated_at":"2026-05-18T06:04:44.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"google/osv-scanner-action","old_version":"1.9.1","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [google/osv-scanner-action](https://github.com/google/osv-scanner-action) from 1.9.1 to 2.3.8.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.5\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.5.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to v2.3.5 by \u003ca href=\"https://github.com/tobyhawker\"\u003e\u003ccode\u003e@​tobyhawker\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/124\"\u003egoogle/osv-scanner-action#124\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tobyhawker\"\u003e\u003ccode\u003e@​tobyhawker\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/124\"\u003egoogle/osv-scanner-action#124\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.3...v2.3.5\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.3...v2.3.5\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.3\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.3.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): update github/codeql-action action to v4.31.10 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/115\"\u003egoogle/osv-scanner-action#115\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate to v2.3.3 by \u003ca href=\"https://github.com/Ly-Joey\"\u003e\u003ccode\u003e@​Ly-Joey\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/118\"\u003egoogle/osv-scanner-action#118\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Ly-Joey\"\u003e\u003ccode\u003e@​Ly-Joey\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/118\"\u003egoogle/osv-scanner-action#118\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.2...v2.3.3\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.2...v2.3.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.2\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.2\u003c/p\u003e\n\u003cp\u003eThis release includes performance improvements for local scanning, reducing memory usage and avoiding unnecessary advisory loading. It also fixes issues with MCP's get_vulnerability_details tool, git queries in \u003ccode\u003eosv-scanner.json\u003c/code\u003e, and ignore entry tracking, along with documentation updates.\u003c/p\u003e\n\u003ch3\u003eFixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2415\"\u003e#2415\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2415\"\u003egoogle/osv-scanner#2415\u003c/a\u003e) Add more PURL-to-ecosystem mappings\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2422\"\u003e#2422\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2422\"\u003egoogle/osv-scanner#2422\u003c/a\u003e) MCP error for get_vulnerability_id because type definition is incorrect.\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2460\"\u003e#2460\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2460\"\u003egoogle/osv-scanner#2460\u003c/a\u003e) Enable osv-scanner.json git queries\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2456\"\u003e#2456\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2456\"\u003egoogle/osv-scanner#2456\u003c/a\u003e) Properly track if an ignore entry has been used\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2450\"\u003e#2450\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2450\"\u003egoogle/osv-scanner#2450\u003c/a\u003e) \u003cstrong\u003ePerformance:\u003c/strong\u003e Avoid loading the entire advisory unless it will actually be used\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2445\"\u003e#2445\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2445\"\u003egoogle/osv-scanner#2445\u003c/a\u003e) \u003cstrong\u003ePerformance:\u003c/strong\u003e Don't read the entire zip into memory\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2433\"\u003e#2433\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2433\"\u003egoogle/osv-scanner#2433\u003c/a\u003e) Allow specifying user agent in v2 osvscanner package\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMisc:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e[Misc \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2453\"\u003e#2453\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2453\"\u003egoogle/osv-scanner#2453\u003c/a\u003e) Switch from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3\u003c/li\u003e\n\u003cli\u003e[Misc \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2447\"\u003e#2447\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2447\"\u003egoogle/osv-scanner#2447\u003c/a\u003e) Include \u003ccode\u003ebun.lock\u003c/code\u003e as a supported lockfile\u003c/li\u003e\n\u003cli\u003e[Misc \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2444\"\u003e#2444\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2444\"\u003egoogle/osv-scanner#2444\u003c/a\u003e) Document GoVersionOverride in configuration.md\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9517144e5504957104c831530fe605bfdc71f353\"\u003e\u003ccode\u003e9517144\u003c/code\u003e\u003c/a\u003e feat: output results in reusable workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f17cd09224d6ef8be953fb49371e6bffb2dbf44a\"\u003e\u003ccode\u003ef17cd09\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into main\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v1.9.1...v2.3.8\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google/osv-scanner-action\u0026package-manager=github_actions\u0026previous-version=1.9.1\u0026new-version=2.3.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/Jobways03/SPORTSMART_OFFICIAL_MM/pull/11","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/Jobways03%2FSPORTSMART_OFFICIAL_MM/issues/11","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/11/packages"},{"uuid":"4462140509","node_id":"PR_kwDORHJBrs7cUAaV","number":74,"state":"closed","title":"chore(gha)(deps): bump the github-actions-minor-and-patch group with 3 updates","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":"2026-05-17T03:25:23.000Z","author_association":null,"state_reason":null,"created_at":"2026-05-17T03:24:18.000Z","updated_at":"2026-05-17T03:25:24.000Z","time_to_close":65,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(gha)(deps): bump","group_name":"github-actions-minor-and-patch","update_count":3,"packages":[{"name":"step-security/harden-runner","old_version":"2.19.1","new_version":"2.19.3","repository_url":"https://github.com/step-security/harden-runner"},{"name":"github/codeql-action","old_version":"4.35.4","new_version":"4.35.5","repository_url":"https://github.com/github/codeql-action"},{"name":"google/osv-scanner-action","old_version":"2.3.5","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions-minor-and-patch group with 3 updates: [step-security/harden-runner](https://github.com/step-security/harden-runner), [github/codeql-action](https://github.com/github/codeql-action) and [google/osv-scanner-action](https://github.com/google/osv-scanner-action).\n\nUpdates `step-security/harden-runner` from 2.19.1 to 2.19.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/step-security/harden-runner/releases\"\u003estep-security/harden-runner's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.19.3\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDefault to audit mode when api-key missing with use-policy-store by \u003ca href=\"https://github.com/varunsh-coder\"\u003e\u003ccode\u003e@​varunsh-coder\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/665\"\u003estep-security/harden-runner#665\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ab7a9404c0f3da075243ca237b5fac12c98deaa5\"\u003e\u003ccode\u003eab7a940\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/665\"\u003e#665\u003c/a\u003e from step-security/fix/use-policy-store-default-audit\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ec41b783c27ed7f0db6855a6d9970abd4572858c\"\u003e\u003ccode\u003eec41b78\u003c/code\u003e\u003c/a\u003e Default to audit mode when api-key missing with use-policy-store\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/9ca718d3bf646d6534007c269a635b3e54cadf99\"\u003e\u003ccode\u003e9ca718d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/664\"\u003e#664\u003c/a\u003e from step-security/update-agent-v1.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/1dee3df8d29f4225c582eee2ddb6053ca616c0df\"\u003e\u003ccode\u003e1dee3df\u003c/code\u003e\u003c/a\u003e Update agent to v1.8.5\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/step-security/harden-runner/compare/a5ad31d6a139d249332a2605b85202e8c0b78450...ab7a9404c0f3da075243ca237b5fac12c98deaa5\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action` from 4.35.4 to 4.35.5\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.35.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal \u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will be enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for GitHub-internal use only, and may change without notice at any time. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning analysis for a PR with \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.5 - 15 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal \u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will be enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for GitHub-internal use only, and may change without notice at any time. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning analysis for a PR with \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.4 - 07 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.3 - 01 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP OIDC are now accepted. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBest-effort connection tests for private registries now use \u003ccode\u003eGET\u003c/code\u003e requests instead of \u003ccode\u003eHEAD\u003c/code\u003e for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3853\"\u003e#3853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3\"\u003e2.25.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3865\"\u003e#3865\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.2 - 15 Apr 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe undocumented TRAP cache cleanup feature that could be enabled using the \u003ccode\u003eCODEQL_ACTION_CLEANUP_TRAP_CACHES\u003c/code\u003e environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the \u003ccode\u003etrap-caching: false\u003c/code\u003e input to the \u003ccode\u003einit\u003c/code\u003e Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3795\"\u003e#3795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3789\"\u003e#3789\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePython analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3794\"\u003e#3794\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3807\"\u003e#3807\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2\"\u003e2.25.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3823\"\u003e#3823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.1 - 27 Mar 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix incorrect minimum required Git version for \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e: it should have been 2.36.0, not 2.11.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3781\"\u003e#3781\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.0 - 27 Mar 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReduced the minimum Git version required for \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e from 2.38.0 to 2.11.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3767\"\u003e#3767\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1\"\u003e2.25.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3773\"\u003e#3773\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.34.1 - 20 Mar 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDowngrade default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3\"\u003e2.24.3\u003c/a\u003e due to issues with a small percentage of Actions and JavaScript analyses. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3762\"\u003e#3762\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.34.0 - 20 Mar 2026\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/9e0d7b8d25671d64c341c19c0152d693099fb5ba\"\u003e\u003ccode\u003e9e0d7b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3905\"\u003e#3905\u003c/a\u003e from github/update-v4.35.5-d4b485515\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6d7d59927c0c7336c1d1247c7e159e79edbf7684\"\u003e\u003ccode\u003e6d7d599\u003c/code\u003e\u003c/a\u003e Add changelog entry for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/51f7e38c69d3cd7966375fe0ffff19669f22bd14\"\u003e\u003ccode\u003e51f7e38\u003c/code\u003e\u003c/a\u003e Update changelog for v4.35.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d4b485515e8531d7071a39d526213eb5b2e74a11\"\u003e\u003ccode\u003ed4b4855\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3899\"\u003e#3899\u003c/a\u003e from github/mbg/esbuild/split\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/127de8117f134e8809c127d53e940b3ffc1db8e9\"\u003e\u003ccode\u003e127de81\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/esbuild/split\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7fde13f26ad3f7008e8fe6755cb997b54f7a2f3b\"\u003e\u003ccode\u003e7fde13f\u003c/code\u003e\u003c/a\u003e Use src + basename in header to avoid issues on Windows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/dfa61e7305ed28b74dcc2c68bd665b36751ad933\"\u003e\u003ccode\u003edfa61e7\u003c/code\u003e\u003c/a\u003e Improve pattern matching and error handling\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/52aafec07347933a26e670390c3f894c5c05e64a\"\u003e\u003ccode\u003e52aafec\u003c/code\u003e\u003c/a\u003e Import and call \u003ccode\u003erunWrapper\u003c/code\u003e normally in \u003ccode\u003eanalyze\u003c/code\u003e tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/0d08c01f7874da2f932e4d4e4d42b1c43be88111\"\u003e\u003ccode\u003e0d08c01\u003c/code\u003e\u003c/a\u003e Auto-generate shared bundle\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/14085a675cb6d8cddc805b946cc1d51e3232a204\"\u003e\u003ccode\u003e14085a6\u003c/code\u003e\u003c/a\u003e Auto-generate entry points\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/68bde559dea0fdcac2102bfdf6230c5f70eb485e...9e0d7b8d25671d64c341c19c0152d693099fb5ba\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action` from 2.3.5 to 2.3.8\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9517144e5504957104c831530fe605bfdc71f353\"\u003e\u003ccode\u003e9517144\u003c/code\u003e\u003c/a\u003e feat: output results in reusable workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f17cd09224d6ef8be953fb49371e6bffb2dbf44a\"\u003e\u003ccode\u003ef17cd09\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into main\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/c51854704019a247608d928f370c98740469d4b5...9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/nathanvale/side-quest-runners/pull/74","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/nathanvale%2Fside-quest-runners/issues/74","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/74/packages"},{"uuid":"4458223145","node_id":"PR_kwDOSe3Vr87cIa2L","number":1,"state":"closed","title":"chore(deps): bump the github-actions group with 9 updates","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":"2026-05-23T00:28:01.000Z","author_association":null,"state_reason":null,"created_at":"2026-05-16T02:33:17.000Z","updated_at":"2026-05-23T00:28:02.000Z","time_to_close":597284,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"github-actions","update_count":9,"packages":[{"name":"actions/checkout","old_version":"3.1.0","new_version":"6.0.2","repository_url":"https://github.com/actions/checkout"},{"name":"step-security/harden-runner","old_version":"2.19.0","new_version":"2.19.3","repository_url":"https://github.com/step-security/harden-runner"},{"name":"github/codeql-action","old_version":"2.1.36","new_version":"4.35.5","repository_url":"https://github.com/github/codeql-action"},{"name":"actions/dependency-review-action","old_version":"4.9.0","new_version":"5.0.0","repository_url":"https://github.com/actions/dependency-review-action"},{"name":"actions/labeler","old_version":"6.0.1","new_version":"6.1.0","repository_url":"https://github.com/actions/labeler"},{"name":"google/osv-scanner-action","old_version":"2.3.5","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"release-drafter/release-drafter","old_version":"7.2.1","new_version":"7.3.0","repository_url":"https://github.com/release-drafter/release-drafter"},{"name":"sigstore/cosign-installer","old_version":"4.1.1","new_version":"4.1.2","repository_url":"https://github.com/sigstore/cosign-installer"},{"name":"crate-ci/typos","old_version":"1.45.2","new_version":"1.46.1","repository_url":"https://github.com/crate-ci/typos"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions group with 9 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/checkout](https://github.com/actions/checkout) | `3.1.0` | `6.0.2` |\n| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.19.0` | `2.19.3` |\n| [github/codeql-action](https://github.com/github/codeql-action) | `2.1.36` | `4.35.5` |\n| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.9.0` | `5.0.0` |\n| [actions/labeler](https://github.com/actions/labeler) | `6.0.1` | `6.1.0` |\n| [google/osv-scanner-action](https://github.com/google/osv-scanner-action) | `2.3.5` | `2.3.8` |\n| [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) | `7.2.1` | `7.3.0` |\n| [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `4.1.1` | `4.1.2` |\n| [crate-ci/typos](https://github.com/crate-ci/typos) | `1.45.2` | `1.46.1` |\n\nUpdates `actions/checkout` from 3.1.0 to 6.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/releases\"\u003eactions/checkout's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by \u003ca href=\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2355\"\u003eactions/checkout#2355\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6.0.1...v6.0.2\"\u003ehttps://github.com/actions/checkout/compare/v6.0.1...v6.0.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all references from v5 and v4 to v6 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2314\"\u003eactions/checkout#2314\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eClarify v6 README by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2328\"\u003eactions/checkout#2328\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6...v6.0.1\"\u003ehttps://github.com/actions/checkout/compare/v6...v6.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ev6-beta by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2298\"\u003eactions/checkout#2298\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate readme/changelog for v6 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2311\"\u003eactions/checkout#2311\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v5.0.0...v6.0.0\"\u003ehttps://github.com/actions/checkout/compare/v5.0.0...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6-beta\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eUpdated persist-credentials to store the credentials under \u003ccode\u003e$RUNNER_TEMP\u003c/code\u003e instead of directly in the local git config.\u003c/p\u003e\n\u003cp\u003eThis requires a minimum Actions Runner version of \u003ca href=\"https://github.com/actions/runner/releases/tag/v2.329.0\"\u003ev2.329.0\u003c/a\u003e to access the persisted credentials for \u003ca href=\"https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action\"\u003eDocker container action\u003c/a\u003e scenarios.\u003c/p\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v5...v5.0.1\"\u003ehttps://github.com/actions/checkout/compare/v5...v5.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare v5.0.0 release by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2238\"\u003eactions/checkout#2238\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e⚠️ Minimum Compatible Runner Version\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003ev2.327.1\u003c/strong\u003e\u003cbr /\u003e\n\u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003eRelease Notes\u003c/a\u003e\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\"\u003eactions/checkout's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v4 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2305\"\u003eactions/checkout#2305\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update README.md by \u003ca href=\"https://github.com/motss\"\u003e\u003ccode\u003e@​motss\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1971\"\u003eactions/checkout#1971\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd internal repos for checking out multiple repositories by \u003ca href=\"https://github.com/mouismail\"\u003e\u003ccode\u003e@​mouismail\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1977\"\u003eactions/checkout#1977\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation update - add recommended permissions to Readme by \u003ca href=\"https://github.com/benwells\"\u003e\u003ccode\u003e@​benwells\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2043\"\u003eactions/checkout#2043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdjust positioning of user email note and permissions heading by \u003ca href=\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2044\"\u003eactions/checkout#2044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca href=\"https://github.com/nebuk89\"\u003e\u003ccode\u003e@​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2194\"\u003eactions/checkout#2194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate CODEOWNERS for actions by \u003ca href=\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2224\"\u003eactions/checkout#2224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate package dependencies by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2236\"\u003eactions/checkout#2236\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eurl-helper.ts\u003c/code\u003e now leverages well-known environment variables by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1941\"\u003eactions/checkout#1941\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpand unit test coverage for \u003ccode\u003eisGhes\u003c/code\u003e by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1946\"\u003eactions/checkout#1946\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck out other refs/* by commit if provided, fall back to ref by \u003ca href=\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1924\"\u003eactions/checkout#1924\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd Ref and Commit outputs by \u003ca href=\"https://github.com/lucacome\"\u003e\u003ccode\u003e@​lucacome\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1180\"\u003eactions/checkout#1180\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDependency updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e- \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1777\"\u003eactions/checkout#1777\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1872\"\u003eactions/checkout#1872\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.1.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1739\"\u003eactions/checkout#1739\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 3 to 4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1697\"\u003eactions/checkout#1697\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCheck out other refs/* by commit by \u003ca href=\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1774\"\u003eactions/checkout#1774\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin actions/checkout's own workflows to a known, good, stable version. by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1776\"\u003eactions/checkout#1776\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.1.6\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck platform to set archive extension appropriately by \u003ca href=\"https://github.com/cory-miller\"\u003e\u003ccode\u003e@​cory-miller\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1732\"\u003eactions/checkout#1732\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/de0fac2e4500dabe0009e67214ff5f5447ce83dd\"\u003e\u003ccode\u003ede0fac2\u003c/code\u003e\u003c/a\u003e Fix tag handling: preserve annotations and explicit fetch-tags (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2356\"\u003e#2356\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/064fe7f3312418007dea2b49a19844a9ee378f49\"\u003e\u003ccode\u003e064fe7f\u003c/code\u003e\u003c/a\u003e Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/8e8c483db84b4bee98b60c0593521ed34d9990e8\"\u003e\u003ccode\u003e8e8c483\u003c/code\u003e\u003c/a\u003e Clarify v6 README (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2328\"\u003e#2328\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/033fa0dc0b82693d8986f1016a0ec2c5e7d9cbb1\"\u003e\u003ccode\u003e033fa0d\u003c/code\u003e\u003c/a\u003e Add worktree support for persist-credentials includeIf (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2327\"\u003e#2327\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5\"\u003e\u003ccode\u003ec2d88d3\u003c/code\u003e\u003c/a\u003e Update all references from v5 and v4 to v6 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2314\"\u003e#2314\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3\"\u003e\u003ccode\u003e1af3b93\u003c/code\u003e\u003c/a\u003e update readme/changelog for v6 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2311\"\u003e#2311\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/71cf2267d89c5cb81562390fa70a37fa40b1305e\"\u003e\u003ccode\u003e71cf226\u003c/code\u003e\u003c/a\u003e v6-beta (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2298\"\u003e#2298\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/069c6959146423d11cd0184e6accf28f9d45f06e\"\u003e\u003ccode\u003e069c695\u003c/code\u003e\u003c/a\u003e Persist creds to a separate file (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2286\"\u003e#2286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493\"\u003e\u003ccode\u003eff7abcd\u003c/code\u003e\u003c/a\u003e Update README to include Node.js 24 support details and requirements (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2248\"\u003e#2248\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/08c6903cd8c0fde910a37f88322edcfb5dd907a8\"\u003e\u003ccode\u003e08c6903\u003c/code\u003e\u003c/a\u003e Prepare v5.0.0 release (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2238\"\u003e#2238\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/checkout/compare/v3.1.0...de0fac2e4500dabe0009e67214ff5f5447ce83dd\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `step-security/harden-runner` from 2.19.0 to 2.19.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/step-security/harden-runner/releases\"\u003estep-security/harden-runner's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.19.3\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDefault to audit mode when api-key missing with use-policy-store by \u003ca href=\"https://github.com/varunsh-coder\"\u003e\u003ccode\u003e@​varunsh-coder\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/665\"\u003estep-security/harden-runner#665\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: detect ubuntu-slim runners early and bail out by \u003ca href=\"https://github.com/devantler\"\u003e\u003ccode\u003e@​devantler\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/657\"\u003estep-security/harden-runner#657\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eWhat the fix changes\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eHarden-Runner will detect \u003ccode\u003eubuntu-slim\u003c/code\u003e runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eWhat the fix does not do\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eJobs running on \u003ccode\u003eubuntu-slim\u003c/code\u003e will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).\u003c/li\u003e\n\u003cli\u003ePer GitHub's docs on \u003ca href=\"https://docs.github.com/en/actions/reference/runners/github-hosted-runners#single-cpu-runners\"\u003esingle-CPU runners\u003c/a\u003e: \u0026quot;The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported.\u0026quot;  Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eFor StepSecurity enterprise customers\nIf your security posture requires that workflows are always monitored, you can block the use of \u003ccode\u003eubuntu-slim\u003c/code\u003e via workflow run policies see the \u003ca href=\"https://docs.stepsecurity.io/workflow-run-policies/policies#runner-label-policy\"\u003eRunner Label Policy\u003c/a\u003e docs. This lets you enforce that jobs only run on monitored runner types.\u003c/p\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/devantler\"\u003e\u003ccode\u003e@​devantler\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/657\"\u003estep-security/harden-runner#657\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ab7a9404c0f3da075243ca237b5fac12c98deaa5\"\u003e\u003ccode\u003eab7a940\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/665\"\u003e#665\u003c/a\u003e from step-security/fix/use-policy-store-default-audit\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ec41b783c27ed7f0db6855a6d9970abd4572858c\"\u003e\u003ccode\u003eec41b78\u003c/code\u003e\u003c/a\u003e Default to audit mode when api-key missing with use-policy-store\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/9ca718d3bf646d6534007c269a635b3e54cadf99\"\u003e\u003ccode\u003e9ca718d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/664\"\u003e#664\u003c/a\u003e from step-security/update-agent-v1.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/1dee3df8d29f4225c582eee2ddb6053ca616c0df\"\u003e\u003ccode\u003e1dee3df\u003c/code\u003e\u003c/a\u003e Update agent to v1.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/a5ad31d6a139d249332a2605b85202e8c0b78450\"\u003e\u003ccode\u003ea5ad31d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/657\"\u003e#657\u003c/a\u003e from devantler/fix/ubuntu-slim-user-env\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/6e928567d74554b8842dd434908da31c593ba85c\"\u003e\u003ccode\u003e6e92856\u003c/code\u003e\u003c/a\u003e build dist and trim ubuntu-slim message\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/4e0504ee086374bdec7064e5c26d48af41ba6209\"\u003e\u003ccode\u003e4e0504e\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into fix/ubuntu-slim-user-env\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/376d25a97f3a1640ff8cbbddaa4af25948df2cf3\"\u003e\u003ccode\u003e376d25a\u003c/code\u003e\u003c/a\u003e fix: detect ubuntu-slim runners early and bail out\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/step-security/harden-runner/compare/8d3c67de8e2fe68ef647c8db1e6a09f647780f40...ab7a9404c0f3da075243ca237b5fac12c98deaa5\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action` from 2.1.36 to 4.35.5\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.35.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal \u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will be enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for GitHub-internal use only, and may change without notice at any time. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning analysis for a PR with \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP OIDC are now accepted. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBest-effort connection tests for private registries now use \u003ccode\u003eGET\u003c/code\u003e requests instead of \u003ccode\u003eHEAD\u003c/code\u003e for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3853\"\u003e#3853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3\"\u003e2.25.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3865\"\u003e#3865\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe undocumented TRAP cache cleanup feature that could be enabled using the \u003ccode\u003eCODEQL_ACTION_CLEANUP_TRAP_CACHES\u003c/code\u003e environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the \u003ccode\u003etrap-caching: false\u003c/code\u003e input to the \u003ccode\u003einit\u003c/code\u003e Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3795\"\u003e#3795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3789\"\u003e#3789\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePython analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3794\"\u003e#3794\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3807\"\u003e#3807\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2\"\u003e2.25.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3823\"\u003e#3823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix incorrect minimum required Git version for \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e: it should have been 2.36.0, not 2.11.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3781\"\u003e#3781\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReduced the minimum Git version required for \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e from 2.38.0 to 2.11.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3767\"\u003e#3767\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1\"\u003e2.25.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3773\"\u003e#3773\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.34.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDowngrade default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3\"\u003e2.24.3\u003c/a\u003e due to issues with a small percentage of Actions and JavaScript analyses. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3762\"\u003e#3762\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.34.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded an experimental change which disables TRAP caching when \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3569\"\u003e#3569\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eWe are rolling out improved incremental analysis to C/C++ analyses that use build mode \u003ccode\u003enone\u003c/code\u003e. We expect this rollout to be complete by the end of April 2026. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3584\"\u003e#3584\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0\"\u003e2.25.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3585\"\u003e#3585\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.33.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3562\"\u003e#3562\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eTo opt out of this change:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eRepositories owned by an organization:\u003c/strong\u003e Create a custom repository property with the name \u003ccode\u003egithub-codeql-file-coverage-on-prs\u003c/code\u003e and the type \u0026quot;True/false\u0026quot;, then set this property to \u003ccode\u003etrue\u003c/code\u003e in the repository's settings. For more information, see \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003eManaging custom properties for repositories in your organization\u003c/a\u003e. Alternatively, if you are using an advanced setup workflow, you can set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUser-owned repositories using default setup:\u003c/strong\u003e Switch to an advanced setup workflow and set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUser-owned repositories using advanced setup:\u003c/strong\u003e Set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3555\"\u003ea bug\u003c/a\u003e which caused the CodeQL Action to fail loading repository properties if a \u0026quot;Multi select\u0026quot; repository property was configured for the repository. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3557\"\u003e#3557\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe CodeQL Action now loads \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003ecustom repository properties\u003c/a\u003e on GitHub Enterprise Server, enabling the customization of features such as \u003ccode\u003egithub-codeql-disable-overlay\u003c/code\u003e that was previously only available on GitHub.com. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3559\"\u003e#3559\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eOnce \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003eprivate package registries\u003c/a\u003e can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3563\"\u003e#3563\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed the retry mechanism for database uploads. Previously this would fail with the error \u0026quot;Response body object should not be disturbed or locked\u0026quot;. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3564\"\u003e#3564\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eA warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3570\"\u003e#3570\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/9e0d7b8d25671d64c341c19c0152d693099fb5ba\"\u003e\u003ccode\u003e9e0d7b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3905\"\u003e#3905\u003c/a\u003e from github/update-v4.35.5-d4b485515\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6d7d59927c0c7336c1d1247c7e159e79edbf7684\"\u003e\u003ccode\u003e6d7d599\u003c/code\u003e\u003c/a\u003e Add changelog entry for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/51f7e38c69d3cd7966375fe0ffff19669f22bd14\"\u003e\u003ccode\u003e51f7e38\u003c/code\u003e\u003c/a\u003e Update changelog for v4.35.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d4b485515e8531d7071a39d526213eb5b2e74a11\"\u003e\u003ccode\u003ed4b4855\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3899\"\u003e#3899\u003c/a\u003e from github/mbg/esbuild/split\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/127de8117f134e8809c127d53e940b3ffc1db8e9\"\u003e\u003ccode\u003e127de81\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/esbuild/split\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7fde13f26ad3f7008e8fe6755cb997b54f7a2f3b\"\u003e\u003ccode\u003e7fde13f\u003c/code\u003e\u003c/a\u003e Use src + basename in header to avoid issues on Windows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/dfa61e7305ed28b74dcc2c68bd665b36751ad933\"\u003e\u003ccode\u003edfa61e7\u003c/code\u003e\u003c/a\u003e Improve pattern matching and error handling\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/52aafec07347933a26e670390c3f894c5c05e64a\"\u003e\u003ccode\u003e52aafec\u003c/code\u003e\u003c/a\u003e Import and call \u003ccode\u003erunWrapper\u003c/code\u003e normally in \u003ccode\u003eanalyze\u003c/code\u003e tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/0d08c01f7874da2f932e4d4e4d42b1c43be88111\"\u003e\u003ccode\u003e0d08c01\u003c/code\u003e\u003c/a\u003e Auto-generate shared bundle\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/14085a675cb6d8cddc805b946cc1d51e3232a204\"\u003e\u003ccode\u003e14085a6\u003c/code\u003e\u003c/a\u003e Auto-generate entry points\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/v2.1.36...v4.35.5\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/dependency-review-action` from 4.9.0 to 5.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/dependency-review-action/releases\"\u003eactions/dependency-review-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e5.0.0\u003c/h2\u003e\n\u003cp\u003eThis is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version \u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003ev2.327.1\u003c/a\u003e to run.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd .github/copilot-instructions.md for Copilot coding agent by \u003ca href=\"https://github.com/ahpook\"\u003e\u003ccode\u003e@​ahpook\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1067\"\u003eactions/dependency-review-action#1067\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate Node.js runtime from 20 to 24 by \u003ca href=\"https://github.com/scottschreckengaust\"\u003e\u003ccode\u003e@​scottschreckengaust\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1084\"\u003eactions/dependency-review-action#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump spdx-license-ids from 3.0.20 to 3.0.23 by \u003ca href=\"https://github.com/mongolyy\"\u003e\u003ccode\u003e@​mongolyy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1091\"\u003eactions/dependency-review-action#1091\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: bump actions/checkout from v4 to v6 in workflow examples by \u003ca href=\"https://github.com/Marukome0743\"\u003e\u003ccode\u003e@​Marukome0743\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1077\"\u003eactions/dependency-review-action#1077\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: patched version display for advisories with non-strict semver ranges (e.g. Maven beta versions) by \u003ca href=\"https://github.com/tspascoal\"\u003e\u003ccode\u003e@​tspascoal\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1076\"\u003eactions/dependency-review-action#1076\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolve security findings by \u003ca href=\"https://github.com/AshelyTC\"\u003e\u003ccode\u003e@​AshelyTC\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1094\"\u003eactions/dependency-review-action#1094\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ev5.0.0 release branch by \u003ca href=\"https://github.com/ahpook\"\u003e\u003ccode\u003e@​ahpook\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1098\"\u003eactions/dependency-review-action#1098\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scottschreckengaust\"\u003e\u003ccode\u003e@​scottschreckengaust\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1084\"\u003eactions/dependency-review-action#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mongolyy\"\u003e\u003ccode\u003e@​mongolyy\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1091\"\u003eactions/dependency-review-action#1091\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Marukome0743\"\u003e\u003ccode\u003e@​Marukome0743\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1077\"\u003eactions/dependency-review-action#1077\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/dependency-review-action/compare/v4.9.0...v5.0.0\"\u003ehttps://github.com/actions/dependency-review-action/compare/v4.9.0...v5.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/a1d282b36b6f3519aa1f3fc636f609c47dddb294\"\u003e\u003ccode\u003ea1d282b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1098\"\u003e#1098\u003c/a\u003e from actions/ahpook/v5-release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/eb6c199c5a85c7387f1f0b02b3ba5c6364740695\"\u003e\u003ccode\u003eeb6c199\u003c/code\u003e\u003c/a\u003e update examples to show \u003ca href=\"https://github.com/v5\"\u003e\u003ccode\u003e@​v5\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/3943c2c5beaaaf1806eb3758273c203dabcbf89c\"\u003e\u003ccode\u003e3943c2c\u003c/code\u003e\u003c/a\u003e v5.0.0 release branch\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/454943c880b147adbfe7de0cdd3ece1c00882033\"\u003e\u003ccode\u003e454943c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1094\"\u003e#1094\u003c/a\u003e from actions/ashelytc/security-findings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/6d92a1228e9e9db334f02c09f84fe9217d2b4463\"\u003e\u003ccode\u003e6d92a12\u003c/code\u003e\u003c/a\u003e revert \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e update\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/a8e5a7e93695b41abf6d1083cd220bee39a720f0\"\u003e\u003ccode\u003ea8e5a7e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1076\"\u003e#1076\u003c/a\u003e from tspascoal/fix-version-matching-for-non-string-s...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/b6b7079031ef4ed61656c221988f1f3bcbf35101\"\u003e\u003ccode\u003eb6b7079\u003c/code\u003e\u003c/a\u003e update \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e to 8.40.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/821a21dd691f162c4c5c2e9754a344accde9a208\"\u003e\u003ccode\u003e821a21d\u003c/code\u003e\u003c/a\u003e update more dependencies\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/05aaaae45cf4c420de012addf2a72e3435ddaa63\"\u003e\u003ccode\u003e05aaaae\u003c/code\u003e\u003c/a\u003e run npm audit fix\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/55d3e754501fc13c84b95637ce51f135012d41ea\"\u003e\u003ccode\u003e55d3e75\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1077\"\u003e#1077\u003c/a\u003e from Marukome0743/docs/checkout\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/dependency-review-action/compare/2031cfc080254a8a887f58cffee85186f0e49e48...a1d282b36b6f3519aa1f3fc636f609c47dddb294\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/labeler` from 6.0.1 to 6.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/labeler/releases\"\u003eactions/labeler's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.1.0\u003c/h2\u003e\n\u003ch2\u003eEnhancements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd changed-files-labels-limit and max-files-changed configuration options to cap the number of labels added by \u003ca href=\"https://github.com/bluca\"\u003e\u003ccode\u003e@​bluca\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/923\"\u003eactions/labeler#923\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImprove Labeler Action documentation and permission error handling by \u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/897\"\u003eactions/labeler#897\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePreserve manually added labels during workflow runs and refine label synchronization logic by \u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/917\"\u003eactions/labeler#917\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDependency Updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/877\"\u003eactions/labeler#877\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade minimatch from 10.0.1 to 10.2.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/926\"\u003eactions/labeler#926\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade dependencies (\u003ccode\u003e@​actions/core\u003c/code\u003e, \u003ccode\u003e@​actions/github\u003c/code\u003e, js-yaml, minimatch, \u003ca href=\"https://github.com/typescript-eslint\"\u003e\u003ccode\u003e@​typescript-eslint\u003c/code\u003e\u003c/a\u003e) by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/934\"\u003eactions/labeler#934\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/897\"\u003eactions/labeler#897\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/bluca\"\u003e\u003ccode\u003e@​bluca\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/923\"\u003eactions/labeler#923\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/934\"\u003eactions/labeler#934\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/labeler/compare/v6...v6.1.0\"\u003ehttps://github.com/actions/labeler/compare/v6...v6.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/f27b608878404679385c85cfa523b85ccb86e213\"\u003e\u003ccode\u003ef27b608\u003c/code\u003e\u003c/a\u003e chore: upgrade dependencies (\u003ccode\u003e@​actions/core\u003c/code\u003e, \u003ccode\u003e@​actions/github\u003c/code\u003e, js-yaml, minimat...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/c5dadc2a45784a4b6adfcd20fea3465da3a5f904\"\u003e\u003ccode\u003ec5dadc2\u003c/code\u003e\u003c/a\u003e Add 'changed-files-labels-limit' and 'max-files-changed' configs to allow cap...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/e52e4fb63ed5cd0e07abaad9826b2a893ccb921f\"\u003e\u003ccode\u003ee52e4fb\u003c/code\u003e\u003c/a\u003e Bump minimatch from 10.0.1 to 10.2.3 (\u003ca href=\"https://redirect.github.com/actions/labeler/issues/926\"\u003e#926\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/77a4082b841706ac431479b7e2bb11216ffef250\"\u003e\u003ccode\u003e77a4082\u003c/code\u003e\u003c/a\u003e Fix: Preserve manually added labels during workflow run and refine label sync...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/25abb3cad4f14b7ac27968a495c37798860a5a1a\"\u003e\u003ccode\u003e25abb3c\u003c/code\u003e\u003c/a\u003e Improve Labeler Action Documentation and Error Handling for Permissions (\u003ca href=\"https://redirect.github.com/actions/labeler/issues/897\"\u003e#897\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/395c8cfdb1e1e691cc4bad0dd315820af8eb67fd\"\u003e\u003ccode\u003e395c8cf\u003c/code\u003e\u003c/a\u003e Bump brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v...\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/labeler/compare/634933edcd8ababfe52f92936142cc22ac488b1b...f27b608878404679385c85cfa523b85ccb86e213\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action` from 2.3.5 to 2.3.8\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9517144e5504957104c831530fe605bfdc71f353\"\u003e\u003ccode\u003e9517144\u003c/code\u003e\u003c/a\u003e feat: output results in reusable workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f17cd09224d6ef8be953fb49371e6bffb2dbf44a\"\u003e\u003ccode\u003ef17cd09\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into main\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/c51854704019a247608d928f370c98740469d4b5...9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `release-drafter/release-drafter` from 7.2.1 to 7.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/release-drafter/release-drafter/releases\"\u003erelease-drafter/release-drafter's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.3.0\u003c/h2\u003e\n\u003ch1\u003eWhat's Changed\u003c/h1\u003e\n\u003ch2\u003eNew\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: recover recently merged PRs missed by associated PRs lag (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1604\"\u003e#1604\u003c/a\u003e) \u003ca href=\"https://github.com/jetersen\"\u003e\u003ccode\u003e@​jetersen\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: switch release discovery to ref comparison and explicit missing-baseline warnings (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1570\"\u003e#1570\u003c/a\u003e) \u003ca href=\"https://github.com/jetersen\"\u003e\u003ccode\u003e@​jetersen\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: restore prerelease-identifier on first run when no prior releases exist (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1602\"\u003e#1602\u003c/a\u003e) \u003ca href=\"https://github.com/jrbeilke\"\u003e\u003ccode\u003e@​jrbeilke\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: prevent using commitish like refs/pull (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1598\"\u003e#1598\u003c/a\u003e) \u003ca href=\"https://github.com/cchanche\"\u003e\u003ccode\u003e@​cchanche\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eMaintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eci: rebuild dist after codegen so generated PRs include bundle updates (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1605\"\u003e#1605\u003c/a\u003e) \u003ca href=\"https://github.com/jetersen\"\u003e\u003ccode\u003e@​jetersen\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: update generated GraphQL types (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1600\"\u003e#1600\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: clarify base repository pr filtering (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1599\"\u003e#1599\u003c/a\u003e) \u003ca href=\"https://github.com/cchanche\"\u003e\u003ccode\u003e@​cchanche\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDependency Updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps-dev): bump postcss from 8.5.8 to 8.5.12 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1597\"\u003e#1597\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/release-drafter/release-drafter/compare/v7.2.1...v7.3.0\"\u003ehttps://github.com/release-drafter/release-drafter/compare/v7.2.1...v7.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/c2e2804cc59f45f57076a99af580d0fedb697927\"\u003e\u003ccode\u003ec2e2804\u003c/code\u003e\u003c/a\u003e chore: release v7.3.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/0c28acd0bcb335f1f86b350a4283045eb03025b9\"\u003e\u003ccode\u003e0c28acd\u003c/code\u003e\u003c/a\u003e feat: recover recently merged PRs missed by associated PRs lag (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1604\"\u003e#1604\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/3052ee00309feb828889940f8ea4fb642ff57f4e\"\u003e\u003ccode\u003e3052ee0\u003c/code\u003e\u003c/a\u003e fix: restore prerelease-identifier on first run when no prior releases exist ...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/0503d11169c6098c4ff53bb412ae8887b6fbb79c\"\u003e\u003ccode\u003e0503d11\u003c/code\u003e\u003c/a\u003e ci: rebuild dist after codegen so generated PRs include bundle updates (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1605\"\u003e#1605\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/a553731db26761b6a6446a23e3a978949cba6e2b\"\u003e\u003ccode\u003ea553731\u003c/code\u003e\u003c/a\u003e chore: update generated GraphQL types (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1600\"\u003e#1600\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/c5dd36151c0584427a1f10cb41d5ba73cebcdad4\"\u003e\u003ccode\u003ec5dd361\u003c/code\u003e\u003c/a\u003e ci: add warning on automatic codegen PRs\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/705c5afff81196e065284562dd78729d4bbdab7a\"\u003e\u003ccode\u003e705c5af\u003c/code\u003e\u003c/a\u003e ci: add maintenance label to automated codegen updates\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/acfaf4fa10f83604f93febbc544d5be415f0458e\"\u003e\u003ccode\u003eacfaf4f\u003c/code\u003e\u003c/a\u003e chore: clarify base repository pr filtering (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1599\"\u003e#1599\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/d181a5a9df5268ebc5c1cdebeaef584ddbe14412\"\u003e\u003ccode\u003ed181a5a\u003c/code\u003e\u003c/a\u003e fix: prevent using commitish like refs/pull (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1598\"\u003e#1598\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/f188d08e9e71d8903f02ca1c5e7aea645a815537\"\u003e\u003ccode\u003ef188d08\u003c/code\u003e\u003c/a\u003e feat: switch release discovery to ref comparison and explicit missing-baselin...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/release-drafter/release-drafter/compare/563bf132657a13ded0b01fcb723c5a58cdd824e2...c2e2804cc59f45f57076a99af580d0fedb697927\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `sigstore/cosign-installer` from 4.1.1 to 4.1.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/sigstore/cosign-installer/releases\"\u003esigstore/cosign-installer's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.1.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump cosign to 3.0.6 in \u003ca href=\"https://redirect.github.com/sigstore/cosign-installer/pull/232\"\u003esigstore/cosign-installer#232\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sigstore/cosign-installer/commit/6f9f17788090df1f26f669e9d70d6ae9567deba6\"\u003e\u003ccode\u003e6f9f177\u003c/code\u003e\u003c/a\u003e Bump cosign to 3.0.6 (\u003ca href=\"https://redirect.github.com/sigstore/cosign-installer/issues/232\"\u003e#232\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sigstore/cosign-installer/commit/b5e753ae2d39589c7b38850b463739151fc67f07\"\u003e\u003ccode\u003eb5e753a\u003c/code\u003e\u003c/a\u003e Bump actions/github-script from 8.0.0 to 9.0.0 (\u003ca href=\"https://redirect.github.com/sigstore/cosign-installer/issues/230\"\u003e#230\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sigstore/cosign-installer/commit/115e4ce455e573aa6e9ba51e8d040ddd5c1378af\"\u003e\u003ccode\u003e115e4ce\u003c/code\u003e\u003c/a\u003e Bump actions/setup-go from 6.3.0 to 6.4.0 (\u003ca href=\"https://redirect.github.com/sigstore/cosign-installer/issues/226\"\u003e#226\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/sigstore/cosign-installer/compare/cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003...6f9f17788090df1f26f669e9d70d6ae9567deba6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `crate-ci/typos` from 1.45.2 to 1.46.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/crate-ci/typos/releases\"\u003ecrate-ci/typos's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.46.1\u003c/h2\u003e\n\u003ch2\u003e[1.46.1] - 2026-05-08\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003econfidentials\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.46.0\u003c/h2\u003e\n\u003ch2\u003e[1.46.0] - 2026-04-30\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated the dictionary with the \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1531\"\u003eApril 2026\u003c/a\u003e changes\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/crate-ci/typos/blob/master/CHANGELOG.md\"\u003ecrate-ci/typos's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChange Log\u003c/h1\u003e\n\u003cp\u003eAll notable changes to this project will be documented in this file.\u003c/p\u003e\n\u003cp\u003eThe format is based on \u003ca href=\"https://keepachangelog.com/\"\u003eKeep a Changelog\u003c/a\u003e\nand this project adheres to \u003ca href=\"https://semver.org/\"\u003eSemantic Versioning\u003c/a\u003e.\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003e[Unreleased] - ReleaseDate\u003c/h2\u003e\n\u003ch2\u003e[1.46.1] - 2026-05-08\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003econfidentials\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.46.0] - 2026-04-30\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated the dictionary with the \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1531\"\u003eApril 2026\u003c/a\u003e changes\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.45.2] - 2026-04-27\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eIgnore ssh ed25519 public keys\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.45.1] - 2026-04-13\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003e(action)\u003c/em\u003e Use a temp dir for caching\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.45.0] - 2026-04-01\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated the dictionary with the \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1509\"\u003eMarch 2026\u003c/a\u003e changes\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.44.0] - 2026-02-27\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated the dictionary with the \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1488\"\u003eFebruary 2026\u003c/a\u003e changes\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.43.5] - 2026-02-16\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003e(pypi)\u003c/em\u003e Hopefully fix the sdist build\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/5374cbf686e897b15713110e233094e2874de7ef\"\u003e\u003ccode\u003e5374cbf\u003c/code\u003e\u003c/a\u003e chore: Release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/52448f5ecf85209e284e8db1c77dd4885885068a\"\u003e\u003ccode\u003e52448f5\u003c/code\u003e\u003c/a\u003e docs: Update changelog\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/030c719ff1afe2ff0f85b84d4f99b7a9a57c3b29\"\u003e\u003ccode\u003e030c719\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1552\"\u003e#1552\u003c/a\u003e from epage/fixes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/7a688c7c08aaa1aa67686848eac4cdd7cb3bb1d2\"\u003e\u003ccode\u003e7a688c7\u003c/code\u003e\u003c/a\u003e fix(dict): Confidentials isn't valid\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/3bcd3b343e2ffaa3d23f8cfe7f78d0f8c2d0d0c6\"\u003e\u003ccode\u003e3bcd3b3\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1548\"\u003e#1548\u003c/a\u003e from crate-ci/renovate/maturin-1.x\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/52940116a3ef7d561b8e27ca5b90db8c8c73b2b5\"\u003e\u003ccode\u003e5294011\u003c/code\u003e\u003c/a\u003e chore(deps): Update compatible (\u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1547\"\u003e#1547\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/c3be3602c76061246a93c9510f5a197dfd4d0552\"\u003e\u003ccode\u003ec3be360\u003c/code\u003e\u003c/a\u003e chore(deps): Update dependency maturin to \u0026gt;=1.13,\u0026lt;1.14\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/bbaefadf97b0ec5fdc942684b647f1a6ab250274\"\u003e\u003ccode\u003ebbaefad\u003c/code\u003e\u003c/a\u003e chore: Release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/c19f54c37f6d3dc392c3424e1fd2b932d6bdac33\"\u003e\u003ccode\u003ec19f54c\u003c/code\u003e\u003c/a\u003e chore: Release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/d65608bb75a732976ed0132999033d5ffcbf481b\"\u003e\u003ccode\u003ed65608b\u003c/code\u003e\u003c/a\u003e docs: Update changelog\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/crate-ci/typos/compare/7c572958218557a3272c2d6719629443b5cc26fd...5374cbf686e897b15713110e233094e2874de7ef\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/actions-marketplace-validations/afadesigns_zshellcheck/pull/1","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions-marketplace-validations%2Fafadesigns_zshellcheck/issues/1","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/1/packages"},{"uuid":"4452187301","node_id":"PR_kwDOSMpAB87b06yA","number":60,"state":"open","title":"build(deps): bump google/osv-scanner-action from 2.3.5 to 2.3.8","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-05-15T07:38:25.000Z","updated_at":"2026-05-16T05:33:44.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"build(deps)","packages":[{"name":"google/osv-scanner-action","old_version":"2.3.5","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [google/osv-scanner-action](https://github.com/google/osv-scanner-action) from 2.3.5 to 2.3.8.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9517144e5504957104c831530fe605bfdc71f353\"\u003e\u003ccode\u003e9517144\u003c/code\u003e\u003c/a\u003e feat: output results in reusable workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f17cd09224d6ef8be953fb49371e6bffb2dbf44a\"\u003e\u003ccode\u003ef17cd09\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into main\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/c51854704019a247608d928f370c98740469d4b5...9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n","html_url":"https://github.com/blamejs/blamejs/pull/60","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/blamejs%2Fblamejs/issues/60","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/60/packages"},{"uuid":"4451334962","node_id":"PR_kwDORTvYl87byQQj","number":188,"state":"open","title":"chore(deps): bump google/osv-scanner-action from 2.3.5 to 2.3.8","user":"dependabot[bot]","labels":["dependencies","ci"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-05-15T04:48:14.000Z","updated_at":"2026-05-15T04:48:22.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps)","packages":[{"name":"google/osv-scanner-action","old_version":"2.3.5","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [google/osv-scanner-action](https://github.com/google/osv-scanner-action) from 2.3.5 to 2.3.8.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9517144e5504957104c831530fe605bfdc71f353\"\u003e\u003ccode\u003e9517144\u003c/code\u003e\u003c/a\u003e feat: output results in reusable workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f17cd09224d6ef8be953fb49371e6bffb2dbf44a\"\u003e\u003ccode\u003ef17cd09\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into main\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/c51854704019a247608d928f370c98740469d4b5...9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google/osv-scanner-action\u0026package-manager=github_actions\u0026previous-version=2.3.5\u0026new-version=2.3.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/takenek/homebridge-xiaomi-air-purifier-modern/pull/188","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/takenek%2Fhomebridge-xiaomi-air-purifier-modern/issues/188","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/188/packages"}],"issue_packages":[{"old_version":"1.9.2","new_version":"2.5.1","update_type":"major","path":null,"pr_created_at":"2026-09-10T19:21:11.000Z","version_change":"1.9.2 → 2.5.1","issue":{"uuid":"5416389983","node_id":"PR_kwDOUVAVB88AAAABDCytaw","number":2,"state":"open","title":"Bump the all-actions group with 12 updates","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-09-10T19:21:11.000Z","updated_at":"2026-09-10T19:26:19.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","group_name":"all-actions","update_count":12,"packages":[{"name":"actions/checkout","old_version":"4.4.0","new_version":"7.0.1","repository_url":"https://github.com/actions/checkout"},{"name":"github/codeql-action/init","old_version":"c20e34f438d671fc35777cc9820dd7adf8252874","new_version":"faaca9a8f6edddba5725ffe5adefdab6669a2eca","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/autobuild","old_version":"c20e34f438d671fc35777cc9820dd7adf8252874","new_version":"faaca9a8f6edddba5725ffe5adefdab6669a2eca","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"c20e34f438d671fc35777cc9820dd7adf8252874","new_version":"faaca9a8f6edddba5725ffe5adefdab6669a2eca","repository_url":"https://github.com/github/codeql-action"},{"name":"actions/setup-node","old_version":"4.4.0","new_version":"7.0.0","repository_url":"https://github.com/actions/setup-node"},{"name":"actions/configure-pages","old_version":"5.0.0","new_version":"6.0.0","repository_url":"https://github.com/actions/configure-pages"},{"name":"actions/attest-build-provenance","old_version":"96b4a1ef7235a096b17240c259729fdd70c83d45","new_version":"e8998f949152b193b063cb0ec769d69d929409be","repository_url":"https://github.com/actions/attest-build-provenance"},{"name":"actions/upload-pages-artifact","old_version":"3.0.1","new_version":"5.0.0","repository_url":"https://github.com/actions/upload-pages-artifact"},{"name":"actions/deploy-pages","old_version":"4.0.5","new_version":"5.0.1","repository_url":"https://github.com/actions/deploy-pages"},{"name":"ossf/scorecard-action","old_version":"55891bbd73f2425e97637d96e306fc9d491d0b21","new_version":"2d1146689b8cda280b9bc96326124645441f03bc","repository_url":"https://github.com/ossf/scorecard-action"},{"name":"github/codeql-action/upload-sarif","old_version":"c20e34f438d671fc35777cc9820dd7adf8252874","new_version":"faaca9a8f6edddba5725ffe5adefdab6669a2eca","repository_url":"https://github.com/github/codeql-action"},{"name":"google/osv-scanner-action","old_version":"1.9.2","new_version":"2.5.1","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"[//]: # (dependabot-start)\n⚠️  **Dependabot is rebasing this PR** ⚠️ \n\nRebasing might not happen immediately, so don't worry if this takes some time.\n\nNote: if you make any changes to this PR yourself, they will take precedence over the rebase.\n\n---\n\n[//]: # (dependabot-end)\n\nBumps the all-actions group with 12 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/checkout](https://github.com/actions/checkout) | `4.4.0` | `7.0.1` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `c20e34f438d671fc35777cc9820dd7adf8252874` | `faaca9a8f6edddba5725ffe5adefdab6669a2eca` |\n| [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `c20e34f438d671fc35777cc9820dd7adf8252874` | `faaca9a8f6edddba5725ffe5adefdab6669a2eca` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `c20e34f438d671fc35777cc9820dd7adf8252874` | `faaca9a8f6edddba5725ffe5adefdab6669a2eca` |\n| [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `7.0.0` |\n| [actions/configure-pages](https://github.com/actions/configure-pages) | `5.0.0` | `6.0.0` |\n| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `96b4a1ef7235a096b17240c259729fdd70c83d45` | `e8998f949152b193b063cb0ec769d69d929409be` |\n| [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) | `3.0.1` | `5.0.0` |\n| [actions/deploy-pages](https://github.com/actions/deploy-pages) | `4.0.5` | `5.0.1` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `55891bbd73f2425e97637d96e306fc9d491d0b21` | `2d1146689b8cda280b9bc96326124645441f03bc` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `c20e34f438d671fc35777cc9820dd7adf8252874` | `faaca9a8f6edddba5725ffe5adefdab6669a2eca` |\n| [google/osv-scanner-action](https://github.com/google/osv-scanner-action) | `1.9.2` | `2.5.1` |\n\nUpdates `actions/checkout` from 4.4.0 to 7.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/releases\"\u003eactions/checkout's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eskip running unsafe pr check if input is default by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2518\"\u003eactions/checkout#2518\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003etrim only ascii whitespace for branch by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2521\"\u003eactions/checkout#2521\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eescape values passed to --unset by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2530\"\u003eactions/checkout#2530\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eVarious dependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v7...v7.0.1\"\u003ehttps://github.com/actions/checkout/compare/v7...v7.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eblock checking out fork pr for pull_request_target and workflow_run by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2458\"\u003eactions/checkout#2458\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.1 to 3.4.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2460\"\u003eactions/checkout#2460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.0 to 4.2.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2461\"\u003eactions/checkout#2461\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e and \u003ccode\u003e@​actions/tool-cache\u003c/code\u003e and Remove uuid by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2459\"\u003eactions/checkout#2459\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupgrade module to esm and update dependencies by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2463\"\u003eactions/checkout#2463\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2462\"\u003eactions/checkout#2462\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003egetting ready for checkout v7 release by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2464\"\u003eactions/checkout#2464\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate error wording by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2467\"\u003eactions/checkout#2467\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6.0.3...v7.0.0\"\u003ehttps://github.com/actions/checkout/compare/v6.0.3...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003e[BREAKING]\u003c/strong\u003e backport \u003ccode\u003eallow-unsafe-pr-checkout\u003c/code\u003e to v6 by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2500\"\u003eactions/checkout#2500\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebackport fixes to releases-v6 by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2527\"\u003eactions/checkout#2527\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/\"\u003ehttps://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/\u003c/a\u003e for more details about this breaking change\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6.0.3...v6.1.0\"\u003ehttps://github.com/actions/checkout/compare/v6.0.3...v6.1.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate changelog by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2357\"\u003eactions/checkout#2357\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate changelog for v6.0.3 by \u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2446\"\u003eactions/checkout#2446\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6...v6.0.3\"\u003ehttps://github.com/actions/checkout/compare/v6...v6.0.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by \u003ca href=\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2355\"\u003eactions/checkout#2355\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\"\u003eactions/checkout's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003ch2\u003ev7.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSkip running unsafe pr check if input is default by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2518\"\u003eactions/checkout#2518\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eTrim only ascii whitespace for branch by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2521\"\u003eactions/checkout#2521\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEscape values passed to --unset by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2530\"\u003eactions/checkout#2530\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eVarious dependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBlock checking out fork PR for pull_request_target and workflow_run by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eVarious dependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v4 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2305\"\u003eactions/checkout#2305\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update README.md by \u003ca href=\"https://github.com/motss\"\u003e\u003ccode\u003e@​motss\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1971\"\u003eactions/checkout#1971\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd internal repos for checking out multiple repositories by \u003ca href=\"https://github.com/mouismail\"\u003e\u003ccode\u003e@​mouismail\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1977\"\u003eactions/checkout#1977\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation update - add recommended permissions to Readme by \u003ca href=\"https://github.com/benwells\"\u003e\u003ccode\u003e@​benwells\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2043\"\u003eactions/checkout#2043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdjust positioning of user email note and permissions heading by \u003ca href=\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2044\"\u003eactions/checkout#2044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca href=\"https://github.com/nebuk89\"\u003e\u003ccode\u003e@​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2194\"\u003eactions/checkout#2194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate CODEOWNERS for actions by \u003ca href=\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2224\"\u003eactions/checkout#2224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate package dependencies by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2236\"\u003eactions/checkout#2236\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eurl-helper.ts\u003c/code\u003e now leverages well-known environment variables by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1941\"\u003eactions/checkout#1941\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpand unit test coverage for \u003ccode\u003eisGhes\u003c/code\u003e by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1946\"\u003eactions/checkout#1946\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck out other refs/* by commit if provided, fall back to ref by \u003ca href=\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1924\"\u003eactions/checkout#1924\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1\"\u003e\u003ccode\u003e3d3c42e\u003c/code\u003e\u003c/a\u003e prep v7.0.1 release (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2531\"\u003e#2531\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07\"\u003e\u003ccode\u003e2880268\u003c/code\u003e\u003c/a\u003e escape values passed to --unset (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2530\"\u003e#2530\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1\"\u003e\u003ccode\u003e12cd223\u003c/code\u003e\u003c/a\u003e trim only ascii whitespace for branch (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2521\"\u003e#2521\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541\"\u003e\u003ccode\u003e62661c4\u003c/code\u003e\u003c/a\u003e skip running unsafe pr check if input is default (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2518\"\u003e#2518\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f\"\u003e\u003ccode\u003ee8d4307\u003c/code\u003e\u003c/a\u003e Bump the minor-actions-dependencies group with 2 updates (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2499\"\u003e#2499\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87\"\u003e\u003ccode\u003e631c942\u003c/code\u003e\u003c/a\u003e eslint 9 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2474\"\u003e#2474\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e\"\u003e\u003ccode\u003e4f1f4ae\u003c/code\u003e\u003c/a\u003e Bump actions/upload-artifact from 4 to 7 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2476\"\u003e#2476\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92\"\u003e\u003ccode\u003eba09753\u003c/code\u003e\u003c/a\u003e Bump actions/checkout from 6 to 7 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2488\"\u003e#2488\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22\"\u003e\u003ccode\u003eb9e0990\u003c/code\u003e\u003c/a\u003e Bump docker/login-action from 3.3.0 to 4.2.0 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2479\"\u003e#2479\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2\"\u003e\u003ccode\u003ee8cb398\u003c/code\u003e\u003c/a\u003e Bump docker/build-push-action from 6.5.0 to 7.2.0 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2478\"\u003e#2478\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/checkout/compare/11d5960a326750d5838078e36cf38b85af677262...3d3c42e5aac5ba805825da76410c181273ba90b1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/init` from c20e34f438d671fc35777cc9820dd7adf8252874 to faaca9a8f6edddba5725ffe5adefdab6669a2eca\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.5 - 03 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.4 - 29 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.3 - 22 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.2 - 21 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote=\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4007\"\u003e#4007\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.1 - 16 Jul 2026\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/github/codeql-action/compare/c20e34f438d671fc35777cc9820dd7adf8252874...faaca9a8f6edddba5725ffe5adefdab6669a2eca\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/autobuild` from c20e34f438d671fc35777cc9820dd7adf8252874 to faaca9a8f6edddba5725ffe5adefdab6669a2eca\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/autobuild's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.5 - 03 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.4 - 29 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.3 - 22 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.2 - 21 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote=\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4007\"\u003e#4007\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.1 - 16 Jul 2026\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/github/codeql-action/compare/c20e34f438d671fc35777cc9820dd7adf8252874...faaca9a8f6edddba5725ffe5adefdab6669a2eca\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from c20e34f438d671fc35777cc9820dd7adf8252874 to faaca9a8f6edddba5725ffe5adefdab6669a2eca\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.5 - 03 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.4 - 29 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.3 - 22 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.2 - 21 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote=\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4007\"\u003e#4007\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.1 - 16 Jul 2026\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/github/codeql-action/compare/c20e34f438d671fc35777cc9820dd7adf8252874...faaca9a8f6edddba5725ffe5adefdab6669a2eca\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/setup-node` from 4.4.0 to 7.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/setup-node/releases\"\u003eactions/setup-node's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancements:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd cache-primary-key and cache-matched-key as outputs by \u003ca href=\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e@​gowridurgad\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1577\"\u003eactions/setup-node#1577\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMigrate to ESM and upgrade dependencies by \u003ca href=\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e@​gowridurgad\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1574\"\u003eactions/setup-node#1574\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug fixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRemove dummy NODE_AUTH_TOKEN export by \u003ca href=\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e@​gowridurgad\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1558\"\u003eactions/setup-node#1558\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eOnly use \u003ccode\u003emirrorToken\u003c/code\u003e in \u003ccode\u003egetManifest\u003c/code\u003e if it's provided by \u003ca href=\"https://github.com/deiga\"\u003e\u003ccode\u003e@​deiga\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1548\"\u003eactions/setup-node#1548\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation updates:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd documentation for publishing to npm with Trusted Publisher (OIDC) by \u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1536\"\u003eactions/setup-node#1536\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: Update restore-only cache documentation by \u003ca href=\"https://github.com/priya-kinthali\"\u003e\u003ccode\u003e@​priya-kinthali\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1550\"\u003eactions/setup-node#1550\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: Update caching recommendations to mitigate cache poisoning risks by \u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1567\"\u003eactions/setup-node#1567\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency update:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​actions/cache\u003c/code\u003e to 5.1.0, log cache write denied by \u003ca href=\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1569\"\u003eactions/setup-node#1569\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1536\"\u003eactions/setup-node#1536\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/deiga\"\u003e\u003ccode\u003e@​deiga\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1548\"\u003eactions/setup-node#1548\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1569\"\u003eactions/setup-node#1569\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/setup-node/compare/v6...v7.0.0\"\u003ehttps://github.com/actions/setup-node/compare/v6...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003e@​actions/cache\u003c/code\u003e to 5.1.0 and add security overrides for undici and fast-xml-parser by \u003ca href=\"https://github.com/HarithaVattikuti\"\u003e\u003ccode\u003e@​HarithaVattikuti\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1579\"\u003eactions/setup-node#1579\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0\"\u003ehttps://github.com/actions/setup-node/compare/v6.4.0...v6.5.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.4.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eDependency updates:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ca href=\"https://github.com/actions\"\u003e\u003ccode\u003e@​actions\u003c/code\u003e\u003c/a\u003e dependencies by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1525\"\u003eactions/setup-node#1525\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate Node.js versions in versions.yml and bump package to v6.4.0  by \u003ca href=\"https://github.com/priya-kinthali\"\u003e\u003ccode\u003e@​priya-kinthali\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1533\"\u003eactions/setup-node#1533\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1525\"\u003eactions/setup-node#1525\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/setup-node/compare/v6...v6.4.0\"\u003ehttps://github.com/actions/setup-node/compare/v6...v6.4.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancements:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport parsing \u003ccode\u003edevEngines\u003c/code\u003e field by \u003ca href=\"https://github.com/susnux\"\u003e\u003ccode\u003e@​susnux\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-node/pull/1283\"\u003eactions/setup-node#1283\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/820762786026740c76f36085b0efc47a31fe5020\"\u003e\u003ccode\u003e8207627\u003c/code\u003e\u003c/a\u003e Migrate to ESM and upgrade dependencies (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1574\"\u003e#1574\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/04be95cf3511ea51ebf9f224ddfb99cc7ab87cd4\"\u003e\u003ccode\u003e04be95c\u003c/code\u003e\u003c/a\u003e Add cache-primary-key and cache-matched-key as outputs (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1577\"\u003e#1577\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/7c2c68d20d402ed6a201ada70a81341941093140\"\u003e\u003ccode\u003e7c2c68d\u003c/code\u003e\u003c/a\u003e docs: Update caching recommendations to mitigate cache poisoning risks (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1567\"\u003e#1567\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/6a61c0375d66246de94630495909f12cf8dac84d\"\u003e\u003ccode\u003e6a61c03\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1569\"\u003e#1569\u003c/a\u003e from jasongin/update-actions-cache-5.1.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/30eb73b41ded577900c1ebf968ef95cdf8f7434f\"\u003e\u003ccode\u003e30eb73b\u003c/code\u003e\u003c/a\u003e Resolve high-severity audit issues\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/4e1a87a501d0302f99e30e2748568adcb388d09f\"\u003e\u003ccode\u003e4e1a87a\u003c/code\u003e\u003c/a\u003e Update dist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/360237f0c01778d0c17291f75c56d6feae4f7574\"\u003e\u003ccode\u003e360237f\u003c/code\u003e\u003c/a\u003e Strict equality\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/4f8aac5beb2f0854bc79651567a18c67eb0b9de3\"\u003e\u003ccode\u003e4f8aac5\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/cache\u003c/code\u003e to 5.1.0, log cache write denied\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/f4a67bbeca970f103397d3d2b9462cf787cd2980\"\u003e\u003ccode\u003ef4a67bb\u003c/code\u003e\u003c/a\u003e Only use \u003ccode\u003emirrorToken\u003c/code\u003e in \u003ccode\u003egetManifest\u003c/code\u003e if it's provided (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1548\"\u003e#1548\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-node/commit/0355742c943ddb13ca8a6b700f824231caa91e75\"\u003e\u003ccode\u003e0355742\u003c/code\u003e\u003c/a\u003e Remove dummy NODE_AUTH_TOKEN export (\u003ca href=\"https://redirect.github.com/actions/setup-node/issues/1558\"\u003e#1558\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/setup-node/compare/49933ea5288caeca8642d1e84afbd3f7d6820020...820762786026740c76f36085b0efc47a31fe5020\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/configure-pages` from 5.0.0 to 6.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/configure-pages/releases\"\u003eactions/configure-pages's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eupgrade to node 24 \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/186\"\u003e#186\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpgrade IA Publish \u003ca href=\"https://github.com/Jcambass\"\u003e\u003ccode\u003e@​Jcambass\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/165\"\u003e#165\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd workflow file for publishing releases to immutable action package \u003ca href=\"https://github.com/Jcambass\"\u003e\u003ccode\u003e@​Jcambass\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/163\"\u003e#163\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003epin draft release version \u003ca href=\"https://github.com/YiMysty\"\u003e\u003ccode\u003e@​YiMysty\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/162\"\u003e#162\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump espree from 9.6.1 to 10.1.0 \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/160\"\u003e#160\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump eslint-config-prettier from 8.8.0 to 9.1.0 \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/143\"\u003e#143\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBe more friendly to Dependabot \u003ca href=\"https://github.com/yoannchaudet\"\u003e\u003ccode\u003e@​yoannchaudet\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/158\"\u003e#158\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump eslint-plugin-github from 4.10.2 to 5.0.1 \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/154\"\u003e#154\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump braces from 3.0.2 to 3.0.3 in the npm_and_yarn group \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/156\"\u003e#156\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump undici from 5.28.3 to 5.28.4 \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/145\"\u003e#145\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSee details of \u003ca href=\"https://github.com/actions/configure-pages/compare/v5.0.0...v5.0.1\"\u003eall code changes\u003c/a\u003e since previous release.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/45bfe0192ca1faeb007ade9deae92b16b8254a0d\"\u003e\u003ccode\u003e45bfe01\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/186\"\u003e#186\u003c/a\u003e from salmanmkc/node24\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/d8770c2b3b71963902cec525cf516368b4411a78\"\u003e\u003ccode\u003ed8770c2\u003c/code\u003e\u003c/a\u003e Update Node version from 20 to 24 in action.yml\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/cb8a1a32801e6cdb7b111ce13761226bba88f67d\"\u003e\u003ccode\u003ecb8a1a3\u003c/code\u003e\u003c/a\u003e upgrade to node 24\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/d5606572c479bee637007364c6b4800ac4fc8573\"\u003e\u003ccode\u003ed560657\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/165\"\u003e#165\u003c/a\u003e from actions/Jcambass-patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/35e0ac4e4038e070ce9da26f41143bc3cf3c7e1d\"\u003e\u003ccode\u003e35e0ac4\u003c/code\u003e\u003c/a\u003e Upgrade IA Publish\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/1dfbcbff6519463927204dc279c2e0d307824ee2\"\u003e\u003ccode\u003e1dfbcbf\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/163\"\u003e#163\u003c/a\u003e from actions/Jcambass-patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/2f4f988792f75a5edcc39df0e1661f78999e0348\"\u003e\u003ccode\u003e2f4f988\u003c/code\u003e\u003c/a\u003e Add workflow file for publishing releases to immutable action package\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/0d7570ca8762e8c951911e8c9655d8973cc93174\"\u003e\u003ccode\u003e0d7570c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/162\"\u003e#162\u003c/a\u003e from actions/pin-draft-release-verssion\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/3ea19669a5cd11c46d23d6578d088b81fe8527e5\"\u003e\u003ccode\u003e3ea1966\u003c/code\u003e\u003c/a\u003e pin draft release version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/aabcbc432d6b06d1fd5e8bf3cf756880c35e014d\"\u003e\u003ccode\u003eaabcbc4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/160\"\u003e#160\u003c/a\u003e from actions/dependabot/npm_and_yarn/espree-10.1.0\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/configure-pages/compare/983d7736d9b0ae728b81ab479565c72886d7745b...45bfe0192ca1faeb007ade9deae92b16b8254a0d\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/attest-build-provenance` from 96b4a1ef7235a096b17240c259729fdd70c83d45 to e8998f949152b193b063cb0ec769d69d929409be\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md\"\u003eactions/attest-build-provenance's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease Instructions\u003c/h1\u003e\n\u003cp\u003eFollow the steps below to tag a new release for the\n\u003ccode\u003eactions/attest-build-provenance\u003c/code\u003e action.\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e\n\u003cp\u003eCreate a new release for the top-level action using a tag of the form\n\u003ccode\u003evX.X.X\u003c/code\u003e following SemVer conventions:\u003c/p\u003e\n\u003cpre lang=\"shell\"\u003e\u003ccode\u003egh release create vX.X.X\n\u003c/code\u003e\u003c/pre\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eMove (or create) the major version tag to point to the same commit tagged\nabove:\u003c/p\u003e\n\u003cpre lang=\"shell\"\u003e\u003ccode\u003egit tag -fa vX -m \u0026quot;vX\u0026quot;\ngit push origin vX --force\n\u003c/code\u003e\u003c/pre\u003e\n\u003c/li\u003e\n\u003c/ol\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/attest-build-provenance/compare/96b4a1ef7235a096b17240c259729fdd70c83d45...e8998f949152b193b063cb0ec769d69d929409be\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/upload-pages-artifact` from 3.0.1 to 5.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/upload-pages-artifact/releases\"\u003eactions/upload-pages-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate upload-artifact action to version 7 \u003ca href=\"https://github.com/Tom-van-Woudenberg\"\u003e\u003ccode\u003e@​Tom-van-Woudenberg\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/issues/139\"\u003e#139\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efeat: add \u003ccode\u003einclude-hidden-files\u003c/code\u003e input \u003ca href=\"https://github.com/jonchurch\"\u003e\u003ccode\u003e@​jonchurch\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/issues/137\"\u003e#137\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSee details of \u003ca href=\"https://github.com/actions/upload-pages-artifact/compare/v4.0.0...v4.0.1\"\u003eall code changes\u003c/a\u003e since previous release.\u003c/p\u003e\n\u003ch2\u003ev4.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePotentially breaking change: hidden files (specifically dotfiles) will not be included in the artifact by \u003ca href=\"https://github.com/tsusdere\"\u003e\u003ccode\u003e@​tsusdere\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/pull/102\"\u003eactions/upload-pages-artifact#102\u003c/a\u003e\nIf you need to include dotfiles in your artifact: instead of using this action, create your own artifact according to these requirements \u003ca href=\"https://github.com/actions/upload-pages-artifact?tab=readme-ov-file#artifact-validation\"\u003ehttps://github.com/actions/upload-pages-artifact?tab=readme-ov-file#artifact-validation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin \u003ccode\u003eactions/upload-artifact\u003c/code\u003e to SHA by \u003ca href=\"https://github.com/heavymachinery\"\u003e\u003ccode\u003e@​heavymachinery\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/pull/127\"\u003eactions/upload-pages-artifact#127\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-pages-artifact/compare/v3.0.1...v4.0.0\"\u003ehttps://github.com/actions/upload-pages-artifact/compare/v3.0.1...v4.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/fc324d3547104276b827a68afc52ff2a11cc49c9\"\u003e\u003ccode\u003efc324d3\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/issues/139\"\u003e#139\u003c/a\u003e from Tom-van-Woudenberg/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/fe9d4b7d84090e1d8d9c53a0236f810d4e00d2c3\"\u003e\u003ccode\u003efe9d4b7\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/0ca16172ca884f0a37117fed41734f29784cc980\"\u003e\u003ccode\u003e0ca1617\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/issues/137\"\u003e#137\u003c/a\u003e from jonchurch/include-hidden-files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/57f0e8492b437b7818227931fef2faa1a379839b\"\u003e\u003ccode\u003e57f0e84\u003c/code\u003e\u003c/a\u003e Update action.yml\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/4a90348b2933470dc78cec55534259872a6d3c0d\"\u003e\u003ccode\u003e4a90348\u003c/code\u003e\u003c/a\u003e v7 --\u0026gt; hash\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/56f665a6f297fa95f8d735b314187fb2d7764569\"\u003e\u003ccode\u003e56f665a\u003c/code\u003e\u003c/a\u003e Update upload-artifact action to version 7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/f7615f5917213b24245d49ba96693d0f5375a414\"\u003e\u003ccode\u003ef7615f5\u003c/code\u003e\u003c/a\u003e Add \u003ccode\u003einclude-hidden-files\u003c/code\u003e input\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/7b1f4a764d45c48632c6b24a0339c27f5614fb0b\"\u003e\u003ccode\u003e7b1f4a7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/issues/127\"\u003e#127\u003c/a\u003e from heavymachinery/pin-sha\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/4cc19c7d3f3e6c87c68366501382a03c8b1ba6db\"\u003e\u003ccode\u003e4cc19c7\u003c/code\u003e\u003c/a\u003e Pin \u003ccode\u003eactions/upload-artifact\u003c/code\u003e to SHA\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/2d163be3ddce01512f3eea7ac5b7023b5d643ce1\"\u003e\u003ccode\u003e2d163be\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/issues/107\"\u003e#107\u003c/a\u003e from KittyChiu/main\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/upload-pages-artifact/compare/56afc609e74202658d3ffba0e8f6dda462b719fa...fc324d3547104276b827a68afc52ff2a11cc49c9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/deploy-pages` from 4.0.5 to 5.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/deploy-pages/releases\"\u003eactions/deploy-pages's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eAdd backoff and jitter to deployment polling \u003ca href=\"https://github.com/yoannchaudet\"\u003e\u003ccode\u003e@​yoannchaudet\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/444\"\u003e#444\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eImprove deployment request test coverage \u003ca href=\"https://github.com/adwitiyagoyal\"\u003e\u003ccode\u003e@​adwitiyagoyal\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/440\"\u003e#440\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003cp\u003eSee details of \u003ca href=\"https://github.com/actions/deploy-pages/compare/v5.0.0...v5.0.1\"\u003eall code changes\u003c/a\u003e since previous release.\u003c/p\u003e\n\u003cp\u003e:warning: For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the \u003ca href=\"https://github.com/actions/deploy-pages/#compatibility\"\u003ecompatibility table\u003c/a\u003e.\u003c/p\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Node.js version to 24.x \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/404\"\u003e#404\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd workflow file for publishing releases to immutable action package \u003ca href=\"https://github.com/Jcambass\"\u003e\u003ccode\u003e@​Jcambass\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/374\"\u003e#374\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump braces from 3.0.2 to 3.0.3 in the npm_and_yarn group across 1 directory \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/360\"\u003e#360\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eMake the rebuild dist workflow work nicer with Dependabot \u003ca href=\"https://github.com/yoannchaudet\"\u003e\u003ccode\u003e@​yoannchaudet\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/361\"\u003e#361\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump the non-breaking-changes group across 1 directory with 3 updates \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/358\"\u003e#358\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDelete repeated sentence \u003ca href=\"https://github.com/garethsb\"\u003e\u003ccode\u003e@​garethsb\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/359\"\u003e#359\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdate README.md \u003ca href=\"https://github.com/tsusdere\"\u003e\u003ccode\u003e@​tsusdere\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/348\"\u003e#348\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump the non-breaking-changes group with 4 updates \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/341\"\u003e#341\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemove error message for file permissions \u003ca href=\"https://github.com/TooManyBees\"\u003e\u003ccode\u003e@​TooManyBees\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/340\"\u003e#340\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003cp\u003eSee details of \u003ca href=\"https://github.com/actions/deploy-pages/compare/v4.0.5...v4.0.6\"\u003eall code changes\u003c/a\u003e since previous release.\u003c/p\u003e\n\u003cp\u003e:warning: For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the \u003ca href=\"https://github.com/actions/deploy-pages/#compatibility\"\u003ecompatibility table\u003c/a\u003e.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/deploy-pages/commit/368f82528645a54fb793d4d04e342629a3f51346\"\u003e\u003ccode\u003e368f825\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/444\"\u003e#444\u003c/a\u003e from actions/yoannchaudet-deployment-polling-backoff\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/deploy-pages/commit/7e97763d1f8271fc88f351a0c275f37de7f32094\"\u003e\u003ccode\u003e7e97763\u003c/code\u003e\u003c/a\u003e Validate deployment polling intervals\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/deploy-pages/commit/0143e11abb4ace1f6858cb44b2ab99eae8a40b45\"\u003e\u003ccode\u003e0143e11\u003c/code\u003e\u003c/a\u003e Add backoff and jitter to deployment polling\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/deploy-pages/commit/5e98f10ce206463e411e82ac66ef0f2df79c5499\"\u003e\u003ccode\u003e5e98f10\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/440\"\u003e#440\u003c/a\u003e from actions/user/adwitiya\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/deploy-pages/commit/8b0625abb54462fce279dc6ce57ef7ce0fb8b8fc\"\u003e\u003ccode\u003e8b0625a\u003c/code\u003e\u003c/a\u003e Improve deployment request test coverage\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/deploy-pages/commit/cd2ce8fcbc39b97be8ca5fce6e763baed58fa128\"\u003e\u003ccode\u003ecd2ce8f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/404\"\u003e#404\u003c/a\u003e from salmanmkc/node24\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/deploy-pages/commit/bbe2a950ee52d4f5cbe74e6d9d6a8803676e91d5\"\u003e\u003ccode\u003ebbe2a95\u003c/code\u003e\u003c/a\u003e Update Node.js version to 24.x\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/deploy-pages/commit/854d7aa1b99e4509c4d1b53d69b7ba4eaf39215a\"\u003e\u003ccode\u003e854d7aa\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/374\"\u003e#374\u003c/a\u003e from actions/Jcambass-patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/deploy-pages/commit/306bb814f29679fd12f0e4b0014bc1f3a7e7f4bc\"\u003e\u003ccode\u003e306bb81\u003c/code\u003e\u003c/a\u003e Add workflow file for publishing releases to immutable action package\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/deploy-pages/commit/b74272834adc04f971da4b0b055c49fa8d7f90c9\"\u003e\u003ccode\u003eb742728\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/deploy-pages/issues/360\"\u003e#360\u003c/a\u003e from actions/dependabot/npm_and_yarn/npm_and_yarn-513...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/deploy-pages/compare/d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e...368f82528645a54fb793d4d04e342629a3f51346\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 55891bbd73f2425e97637d96e306fc9d491d0b21 to 2d1146689b8cda280b9bc96326124645441f03bc\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/RELEASE.md\"\u003eossf/scorecard-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleasing the scorecard GitHub Action\u003c/h1\u003e\n\u003cp\u003eThis is a draft document to describe the release process for the scorecard\nGitHub Action.\u003c/p\u003e\n\u003cp\u003e(If there are improvements you'd like to see, please comment on the\n\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/33\"\u003etracking issue\u003c/a\u003e or issue a\npull request to discuss.)\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#tracking\"\u003eTracking\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#preparing-the-release\"\u003ePreparing the release\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#validate-the-action\"\u003eValidate the Action\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#update-the-scorecard-version\"\u003eUpdate the scorecard version\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#drafting-release-notes\"\u003eDrafting release notes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#release\"\u003eRelease\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#create-a-tag\"\u003eCreate a tag\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#create-a-github-release\"\u003eCreate a GitHub release\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#update-the-starter-workflow\"\u003eUpdate the starter workflow\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/blob/main/#announce\"\u003eAnnounce\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eTracking\u003c/h2\u003e\n\u003cp\u003eAs the first task, a Release Manager should open a tracking issue for the\nrelease.\u003c/p\u003e\n\u003cp\u003eWe don't currently have a template for releasing, but the following\n\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/97\"\u003eissue\u003c/a\u003e is a good example\nto draw inspiration from.\u003c/p\u003e\n\u003cp\u003eWe're not striving for perfection with the template, but the tracking issue\nwill serve as a reference point to aggregate feedback, so try your best to be\nas descriptive as possible.\u003c/p\u003e\n\u003ch2\u003ePreparing the release\u003c/h2\u003e\n\u003cp\u003eThis section covers changes that need to be issued as a pull request and should\nbe merged before releasing the scorecard GitHub Action.\u003c/p\u003e\n\u003ch3\u003eValidate the Action\u003c/h3\u003e\n\u003cp\u003eManually run the workflow \u003ca href=\"https://github.com/ossf/scorecard-action/actions/workflows/scorecards.yml\"\u003escorecards.yml\u003c/a\u003e\nand verify that the run succeeds.\u003c/p\u003e\n\u003ch3\u003eUpdate the scorecard-action version\u003c/h3\u003e\n\u003cp\u003eNOTE: we have a chicken-and-egg problem where the commit to be used for the release\nneeds to have the image tag that only gets created \u003cem\u003eafter\u003c/em\u003e the commit is pushed. We\nworkaround that by pre-selecting and referencing the image tag instead of the SHA which isn't ideal\nbut workable.\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/55891bbd73f2425e97637d96e306fc9d491d0b21...2d1146689b8cda280b9bc96326124645441f03bc\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from c20e34f438d671fc35777cc9820dd7adf8252874 to faaca9a8f6edddba5725ffe5adefdab6669a2eca\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.38.0 - 09 Sept 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOn GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4124\"\u003e#4124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0\"\u003e2.27.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4129\"\u003e#4129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.5 - 03 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.4 - 29 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.3 - 22 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.2 - 21 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote=\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that re...\n\n_Description has been truncated_","html_url":"https://github.com/CristianNichifor/digital-romania-atlas/pull/2","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/CristianNichifor%2Fdigital-romania-atlas/issues/2","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/2/packages"}},{"old_version":"2.0.2","new_version":"2.5.1","update_type":"minor","path":null,"pr_created_at":"2026-09-10T18:20:48.000Z","version_change":"2.0.2 → 2.5.1","issue":{"uuid":"5415831181","node_id":"PR_kwDOUVfnxM8AAAABDCWOzQ","number":8,"state":"open","title":"Bump google/osv-scanner-action from 2.0.2 to 2.5.1","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-09-10T18:20:48.000Z","updated_at":"2026-09-10T18:20:49.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"google/osv-scanner-action","old_version":"2.0.2","new_version":"2.5.1","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [google/osv-scanner-action](https://github.com/google/osv-scanner-action) from 2.0.2 to 2.5.1.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.1\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions/checkout action to v7 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/133\"\u003egoogle/osv-scanner-action#133\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve package namespaces when querying osv.dev API (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2978\"\u003e#2978\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eRe-add support for the \u003ccode\u003eOSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY\u003c/code\u003e environment variable (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2983\"\u003e#2983\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eFix local vulnerability matching (\u003ccode\u003e--offline-vulnerabilities\u003c/code\u003e) not working when network capability is \u003ccode\u003eNetworkOnline\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.5.0 as well as:\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: gate reusable workflow outputs with a flag by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/130\"\u003egoogle/osv-scanner-action#130\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin download-artifact action to SHA by \u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add runs-on input to reusable workflows by \u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: address zizmor warnings by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/135\"\u003egoogle/osv-scanner-action#135\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: add GOTOOLCHAIN=auto env to osv-scanner calls by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/138\"\u003egoogle/osv-scanner-action#138\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.5\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.5.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to v2.3.5 by \u003ca href=\"https://github.com/tobyhawker\"\u003e\u003ccode\u003e@​tobyhawker\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/124\"\u003egoogle/osv-scanner-action#124\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tobyhawker\"\u003e\u003ccode\u003e@​tobyhawker\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/124\"\u003egoogle/osv-scanner-action#124\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.3...v2.3.5\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.3...v2.3.5\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.3\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.3.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/6e4298ebc4db23e847df9b2e2de2939d6f066c67\"\u003e\u003ccode\u003e6e4298e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/141\"\u003e#141\u003c/a\u003e from google/update-to-v2.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/5957b4e7a8725730a37d973099c16b9fe44cfc5f\"\u003e\u003ccode\u003e5957b4e\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.1 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/880d9b542cc66d36d91d51b3fbcc038f5f28cfc5\"\u003e\u003ccode\u003e880d9b5\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.1 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/baa4139e56d6312335d899e6ba045fa16d1d3d0b\"\u003e\u003ccode\u003ebaa4139\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.5.1 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f4cfcc01edc9c8b756a9b873b7a623ca674da51e\"\u003e\u003ccode\u003ef4cfcc0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/117\"\u003e#117\u003c/a\u003e from renovate-bot/renovate/workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dfd4cd1d0114e5fc71a6862faf1114ed69d9dca7\"\u003e\u003ccode\u003edfd4cd1\u003c/code\u003e\u003c/a\u003e Update workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/e13f842f8f0b5845b610f16e8a2eb7f22a7f8677\"\u003e\u003ccode\u003ee13f842\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/133\"\u003e#133\u003c/a\u003e from renovate-bot/renovate/major-workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8deb546fdb875b9996d27d4950be7312dac076a1\"\u003e\u003ccode\u003e8deb546\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/140\"\u003e#140\u003c/a\u003e from google/update-to-v2.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8fb3f8c89519ea2c868d3277441ee7fd3c7f15af\"\u003e\u003ccode\u003e8fb3f8c\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.0 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/0c58c542420dfd23fcac08dd9c8ca3cca9c36f1a\"\u003e\u003ccode\u003e0c58c54\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.0 actions\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.0.2...v2.5.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google/osv-scanner-action\u0026package-manager=github_actions\u0026previous-version=2.0.2\u0026new-version=2.5.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/knowmunever-creator/automatic-computing-machine/pull/8","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/knowmunever-creator%2Fautomatic-computing-machine/issues/8","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/8/packages"}},{"old_version":"2.3.8","new_version":"2.5.1","update_type":"minor","path":null,"pr_created_at":"2026-09-04T15:09:43.000Z","version_change":"2.3.8 → 2.5.1","issue":{"uuid":"5349766474","node_id":"PR_kwDOTT8pz88AAAABCOApYg","number":21,"state":"closed","title":"chore(deps): bump the actions group across 1 directory with 10 updates","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-09-10T18:54:57.000Z","author_association":null,"state_reason":null,"created_at":"2026-09-04T15:09:43.000Z","updated_at":"2026-09-10T18:55:07.000Z","time_to_close":531914,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"actions","update_count":10,"packages":[{"name":"docker/setup-qemu-action","old_version":"4.2.0","new_version":"4.3.0","repository_url":"https://github.com/docker/setup-qemu-action"},{"name":"docker/setup-buildx-action","old_version":"4.2.0","new_version":"4.3.0","repository_url":"https://github.com/docker/setup-buildx-action"},{"name":"docker/login-action","old_version":"4.4.0","new_version":"4.6.0","repository_url":"https://github.com/docker/login-action"},{"name":"github/codeql-action/upload-sarif","old_version":"4.37.0","new_version":"4.37.9","repository_url":"https://github.com/github/codeql-action"},{"name":"actions/setup-go","old_version":"6.5.0","new_version":"7.0.0","repository_url":"https://github.com/actions/setup-go"},{"name":"anchore/sbom-action/download-syft","old_version":"0.24.0","new_version":"0.24.2","repository_url":"https://github.com/anchore/sbom-action"},{"name":"actions/attest-build-provenance","old_version":"4.1.1","new_version":"4.2.2","repository_url":"https://github.com/actions/attest-build-provenance"},{"name":"softprops/action-gh-release","old_version":"3.0.1","new_version":"3.0.3","repository_url":"https://github.com/softprops/action-gh-release"},{"name":"google/osv-scanner-action","old_version":"2.3.8","new_version":"2.5.1","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"ossf/scorecard-action","old_version":"2.4.3","new_version":"2.4.4","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the actions group with 10 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `4.2.0` | `4.3.0` |\n| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.2.0` | `4.3.0` |\n| [docker/login-action](https://github.com/docker/login-action) | `4.4.0` | `4.6.0` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.0` | `4.37.9` |\n| [actions/setup-go](https://github.com/actions/setup-go) | `6.5.0` | `7.0.0` |\n| [anchore/sbom-action/download-syft](https://github.com/anchore/sbom-action) | `0.24.0` | `0.24.2` |\n| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `4.1.1` | `4.2.2` |\n| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.1` | `3.0.3` |\n| [google/osv-scanner-action](https://github.com/google/osv-scanner-action) | `2.3.8` | `2.5.1` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.3` | `2.4.4` |\n\n\nUpdates `docker/setup-qemu-action` from 4.2.0 to 4.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/docker/setup-qemu-action/releases\"\u003edocker/setup-qemu-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.92.0 to 0.96.0 in \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/pull/336\"\u003edocker/setup-qemu-action#336\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​sigstore/verify\u003c/code\u003e from 3.1.0 to 3.1.1 in \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/pull/316\"\u003edocker/setup-qemu-action#316\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump brace-expansion from 1.1.15 to 1.1.18 in \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/pull/332\"\u003edocker/setup-qemu-action#332\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.2.0 to 4.3.1 in \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/pull/334\"\u003edocker/setup-qemu-action#334\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump postcss from 8.5.10 to 8.5.25 in \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/pull/331\"\u003edocker/setup-qemu-action#331\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump sigstore from 4.1.0 to 4.1.1 in \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/pull/317\"\u003edocker/setup-qemu-action#317\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 6.27.0 to 6.28.0 in \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/pull/333\"\u003edocker/setup-qemu-action#333\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/setup-qemu-action/compare/v4.2.0...v4.3.0\"\u003ehttps://github.com/docker/setup-qemu-action/compare/v4.2.0...v4.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-qemu-action/commit/1f40c72289eff860ee54a304f1438e3cff362e0a\"\u003e\u003ccode\u003e1f40c72\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/issues/336\"\u003e#336\u003c/a\u003e from docker/dependabot/npm_and_yarn/docker/actions-to...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-qemu-action/commit/932216e29e2417c3aa0bc5aec3c57089030cef2c\"\u003e\u003ccode\u003e932216e\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-qemu-action/commit/a39e895360e601ae54e9ac97b8ea3b99e5f40491\"\u003e\u003ccode\u003ea39e895\u003c/code\u003e\u003c/a\u003e build(deps): bump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.92.0 to 0.96.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-qemu-action/commit/a98ae9ffe777adf16ca44873bab9926427b262fa\"\u003e\u003ccode\u003ea98ae9f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/issues/333\"\u003e#333\u003c/a\u003e from docker/dependabot/npm_and_yarn/undici-6.28.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-qemu-action/commit/8ebc9d118344dda0af3e25d2a7330010dd33e951\"\u003e\u003ccode\u003e8ebc9d1\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-qemu-action/commit/c41e3fcbc0d6742101e0310c3b008ac3b16a9529\"\u003e\u003ccode\u003ec41e3fc\u003c/code\u003e\u003c/a\u003e build(deps): bump undici from 6.27.0 to 6.28.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-qemu-action/commit/5fc60dfac60f723a3386e73530ff8067f2848f60\"\u003e\u003ccode\u003e5fc60df\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/issues/332\"\u003e#332\u003c/a\u003e from docker/dependabot/npm_and_yarn/brace-expansion-1...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-qemu-action/commit/a26e892bb646b50218299a9b391e7a4b0322d96a\"\u003e\u003ccode\u003ea26e892\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/issues/328\"\u003e#328\u003c/a\u003e from docker/dependabot/github_actions/actions/checkou...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-qemu-action/commit/aa6d04232374700651c6e7be400e859600041423\"\u003e\u003ccode\u003eaa6d042\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/issues/324\"\u003e#324\u003c/a\u003e from docker/dependabot/github_actions/actions/setup-n...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-qemu-action/commit/d381ce5c16de15c000da8929fd1fc6e8fdef19e1\"\u003e\u003ccode\u003ed381ce5\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-qemu-action/issues/317\"\u003e#317\u003c/a\u003e from docker/dependabot/npm_and_yarn/sigstore-4.1.1\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/docker/setup-qemu-action/compare/96fe6ef7f33517b61c61be40b68a1882f3264fb8...1f40c72289eff860ee54a304f1438e3cff362e0a\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `docker/setup-buildx-action` from 4.2.0 to 4.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/docker/setup-buildx-action/releases\"\u003edocker/setup-buildx-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.92.0 to 0.95.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/595\"\u003edocker/setup-buildx-action#595\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump brace-expansion from 1.1.13 to 1.1.18 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/600\"\u003edocker/setup-buildx-action#600\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 5.2.0 to 5.3.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/585\"\u003edocker/setup-buildx-action#585\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump postcss from 8.5.10 to 8.5.25 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/598\"\u003edocker/setup-buildx-action#598\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 6.27.0 to 6.28.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/601\"\u003edocker/setup-buildx-action#601\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/v4.2.0...v4.3.0\"\u003ehttps://github.com/docker/setup-buildx-action/compare/v4.2.0...v4.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/37fe631027851001ddb9b187196cc803df7f5f0e\"\u003e\u003ccode\u003e37fe631\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/595\"\u003e#595\u003c/a\u003e from docker/dependabot/npm_and_yarn/docker/actions-to...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/b5c4f91922681cc7c58d15ab7838986951f09d19\"\u003e\u003ccode\u003eb5c4f91\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/3e93b637c6430ba8fa896fad44d3aa6821899d63\"\u003e\u003ccode\u003e3e93b63\u003c/code\u003e\u003c/a\u003e build(deps): bump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.92.0 to 0.95.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/e527031b32c86649307d5d492506855f90470604\"\u003e\u003ccode\u003ee527031\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/600\"\u003e#600\u003c/a\u003e from docker/dependabot/npm_and_yarn/brace-expansion-1...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/c68814b33cb66f1f7538e546190d410ae557a640\"\u003e\u003ccode\u003ec68814b\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/3f891b01bd5012a434f582800366972569aa1886\"\u003e\u003ccode\u003e3f891b0\u003c/code\u003e\u003c/a\u003e build(deps): bump brace-expansion from 1.1.13 to 1.1.18\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/787db26fcde8ddcabd49a81472318028f7113962\"\u003e\u003ccode\u003e787db26\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/585\"\u003e#585\u003c/a\u003e from docker/dependabot/npm_and_yarn/js-yaml-5.2.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/f7793687c711790ca336bd4934f1b1bf5f778e17\"\u003e\u003ccode\u003ef779368\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/7d5e60413489a33d28077e11d71c668580cfaf8d\"\u003e\u003ccode\u003e7d5e604\u003c/code\u003e\u003c/a\u003e build(deps): bump js-yaml from 5.2.0 to 5.3.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/292c2fb3837a12d3ac2d1e47bbc5c00712bad939\"\u003e\u003ccode\u003e292c2fb\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/590\"\u003e#590\u003c/a\u003e from docker/dependabot/github_actions/actions/setup-n...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/bb05f3f5519dd87d3ba754cc423b652a5edd6d2c...37fe631027851001ddb9b187196cc803df7f5f0e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `docker/login-action` from 4.4.0 to 4.6.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/docker/login-action/releases\"\u003edocker/login-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.6.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eHarden buildx scoped config path handling by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1059\"\u003edocker/login-action#1059\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​aws-sdk/client-ecr\u003c/code\u003e and \u003ccode\u003e@​aws-sdk/client-ecr-public\u003c/code\u003e to 3.1095.0 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1051\"\u003edocker/login-action#1051\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 5.2.1 to 5.2.2 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1057\"\u003edocker/login-action#1057\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump postcss from 8.5.10 to 8.5.22 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1056\"\u003edocker/login-action#1056\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/login-action/compare/v4.5.2...v4.6.0\"\u003ehttps://github.com/docker/login-action/compare/v4.5.2...v4.6.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.5.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSurface Docker Hub OIDC error responses by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1058\"\u003edocker/login-action#1058\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/login-action/compare/v4.5.1...v4.5.2\"\u003ehttps://github.com/docker/login-action/compare/v4.5.1...v4.5.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.5.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSupport \u003ccode\u003edhi.io\u003c/code\u003e as Docker Hub OIDC registry by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1054\"\u003edocker/login-action#1054\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/login-action/compare/v4.5.0...v4.5.1\"\u003ehttps://github.com/docker/login-action/compare/v4.5.0...v4.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.5.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action#docker-hub\"\u003eDocker Hub OIDC\u003c/a\u003e login support by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1048\"\u003edocker/login-action#1048\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​aws-sdk/client-ecr\u003c/code\u003e and \u003ccode\u003e@​aws-sdk/client-ecr-public\u003c/code\u003e to 3.1091.0 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1037\"\u003edocker/login-action#1037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.92.0 to 0.94.0 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1044\"\u003edocker/login-action#1044\u003c/a\u003e \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1050\"\u003edocker/login-action#1050\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump brace-expansion from 1.1.13 to 1.1.16 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1046\"\u003edocker/login-action#1046\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 5.2.0 to 5.2.1 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/1038\"\u003edocker/login-action#1038\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/login-action/compare/v4.4.0...v4.5.0\"\u003ehttps://github.com/docker/login-action/compare/v4.4.0...v4.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/dbcb813823bdd20940b903addbd779551569679f\"\u003e\u003ccode\u003edbcb813\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/login-action/issues/1051\"\u003e#1051\u003c/a\u003e from docker/dependabot/npm_and_yarn/aws-sdk-dependen...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/5bcb015ee6ec720ecdeaef2dc1164122e9b209fc\"\u003e\u003ccode\u003e5bcb015\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/b30b2f2d3196c1714318ba0c3c3bec211d949752\"\u003e\u003ccode\u003eb30b2f2\u003c/code\u003e\u003c/a\u003e build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/9087f1e6d666fe0292409e3c819680c18526e108\"\u003e\u003ccode\u003e9087f1e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/login-action/issues/1057\"\u003e#1057\u003c/a\u003e from docker/dependabot/npm_and_yarn/js-yaml-5.2.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/0009830ea169ca16c24c0ea4cac1c325bfa3aee4\"\u003e\u003ccode\u003e0009830\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/23255232d3e43c8f0052d9a0dba82a515a88ce92\"\u003e\u003ccode\u003e2325523\u003c/code\u003e\u003c/a\u003e build(deps): bump js-yaml from 5.2.1 to 5.2.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/4ec1d4a769e8b05a89a7396551dc38b329211688\"\u003e\u003ccode\u003e4ec1d4a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/login-action/issues/1056\"\u003e#1056\u003c/a\u003e from docker/dependabot/npm_and_yarn/postcss-8.5.22\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/5fc99ba47bca274c5a499688f71c7ea79c0ea1b3\"\u003e\u003ccode\u003e5fc99ba\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/login-action/issues/1053\"\u003e#1053\u003c/a\u003e from docker/dependabot/github_actions/aws-actions/co...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/e512bd59d16c53d79ea5c0f0e345fe554453c4bb\"\u003e\u003ccode\u003ee512bd5\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/login-action/issues/1052\"\u003e#1052\u003c/a\u003e from docker/dependabot/github_actions/codeql-actions...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/a146c91b8f371700d323bae808af7cbdc2766ed5\"\u003e\u003ccode\u003ea146c91\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/login-action/issues/1059\"\u003e#1059\u003c/a\u003e from crazy-max/harden-buildx-scope-paths\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/docker/login-action/compare/af1e73f918a031802d376d3c8bbc3fe56130a9b0...dbcb813823bdd20940b903addbd779551569679f\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.37.0 to 4.37.9\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.37.9\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.8\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.37.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.6\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.3\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.37.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote=\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4007\"\u003e#4007\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\"\u003e2.26.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4019\"\u003e#4019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/upload-sarif's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and download the native \u003ccode\u003elinux-arm64\u003c/code\u003e CodeQL bundle when available. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4072\"\u003e#4072\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.5 - 03 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.4 - 29 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.3 - 22 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.2 - 21 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote=\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4007\"\u003e#4007\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.1 - 16 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\"\u003e2.26.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4019\"\u003e#4019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.0 - 08 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/cdf488f595d80d6e07e03d4674febd5ab45fa938\"\u003e\u003ccode\u003ecdf488f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4107\"\u003e#4107\u003c/a\u003e from github/update-v4.37.9-920ba7cd1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7243f38558d187dde99730d224bb47aa26a95306\"\u003e\u003ccode\u003e7243f38\u003c/code\u003e\u003c/a\u003e Update changelog for v4.37.9\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/920ba7cd1596037e042122c00381eb16b397d68e\"\u003e\u003ccode\u003e920ba7c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4106\"\u003e#4106\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ecfa6e16817b8f490bc9a59baa391baf4fa3e3c2\"\u003e\u003ccode\u003eecfa6e1\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/adcdf4a70d247343cf9c29e0f7a6658b51c3a2b1\"\u003e\u003ccode\u003eadcdf4a\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/486fec2a3ea2626afcd8c7e9208b4f515078dd7e\"\u003e\u003ccode\u003e486fec2\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4099\"\u003e#4099\u003c/a\u003e from github/update-supported-enterprise-server-versions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/134624c67b20869c2aaa36dafa726375b78a5d76\"\u003e\u003ccode\u003e134624c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4101\"\u003e#4101\u003c/a\u003e from github/dependabot/npm_and_yarn/npm-minor-457d82...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ff43db8f982a368288f117354fb8d046e937124c\"\u003e\u003ccode\u003eff43db8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4103\"\u003e#4103\u003c/a\u003e from github/mergeback/v4.37.8-to-main-db488dde\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4605e03a74cf891614c4d76f82384a16c1c11816\"\u003e\u003ccode\u003e4605e03\u003c/code\u003e\u003c/a\u003e Rebuild\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/099c869cad6bf3b88657154d4ae47ffed27e632d\"\u003e\u003ccode\u003e099c869\u003c/code\u003e\u003c/a\u003e Update changelog and version after v4.37.8\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...cdf488f595d80d6e07e03d4674febd5ab45fa938\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/setup-go` from 6.5.0 to 7.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/setup-go/releases\"\u003eactions/setup-go's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate to ESM and upgrade dependencies by \u003ca href=\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-go/pull/763\"\u003eactions/setup-go#763\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 by \u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-go/pull/771\"\u003eactions/setup-go#771\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-go/pull/771\"\u003eactions/setup-go#771\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/setup-go/compare/v6...v7.0.0\"\u003ehttps://github.com/actions/setup-go/compare/v6...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-go/commit/b7ad1dad31e06c5925ef5d2fc7ad053ef454303e\"\u003e\u003ccode\u003eb7ad1da\u003c/code\u003e\u003c/a\u003e chore(deps): bump \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 (\u003ca href=\"https://redirect.github.com/actions/setup-go/issues/771\"\u003e#771\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-go/commit/0778a10ce47b5d450cf60fb94fafad4330008a35\"\u003e\u003ccode\u003e0778a10\u003c/code\u003e\u003c/a\u003e Migrate to ESM and upgrade dependencies (\u003ca href=\"https://redirect.github.com/actions/setup-go/issues/763\"\u003e#763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `anchore/sbom-action/download-syft` from 0.24.0 to 0.24.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/anchore/sbom-action/releases\"\u003eanchore/sbom-action/download-syft's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.24.2\u003c/h2\u003e\n\u003ch3\u003eAdded Features\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebump eslint from 10.8.1 to 10.9.0 [\u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/724\"\u003e#724\u003c/a\u003e \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eAdditional Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eadd makefile target to bump syft [\u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/620\"\u003e#620\u003c/a\u003e \u003ca href=\"https://github.com/willmurphyscode\"\u003e\u003ccode\u003e@​willmurphyscode\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eupdate zizmor workflow triggers [\u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/624\"\u003e#624\u003c/a\u003e \u003ca href=\"https://github.com/wagoodman\"\u003e\u003ccode\u003e@​wagoodman\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003erequire zizmor security events [\u003ca href=\"https://redirect.github.com/anchore/sbom-action/pull/621\"\u003e#621\u003c/a\u003e \u003ca href=\"https://github.com/wagoodman\"\u003e\u003ccode\u003e@​wagoodman\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/anchore/sbom-action/compare/v0.24.0...v0.24.2\"\u003e(Full Changelog)\u003c/a\u003e\u003c/strong\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/3ad7283483fc7af8ff2b4ea19663c2d5ca935e26\"\u003e\u003ccode\u003e3ad7283\u003c/code\u003e\u003c/a\u003e ops: update write permissions for release (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/723\"\u003e#723\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/31f5287d0c257c8bc49b610d01b16bd7c4c89482\"\u003e\u003ccode\u003e31f5287\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump eslint from 10.8.1 to 10.9.0 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/724\"\u003e#724\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/aa80c8c5bd439a416a62804f2151ab38c671a638\"\u003e\u003ccode\u003eaa80c8c\u003c/code\u003e\u003c/a\u003e chore(deps): update Syft to latest release (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/722\"\u003e#722\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/74b54e97f669d9e2e6b728114eac6a92940f9c1c\"\u003e\u003ccode\u003e74b54e9\u003c/code\u003e\u003c/a\u003e chore(deps): bump lodash from 4.17.23 to 4.18.1 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/623\"\u003e#623\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/6b92ff5b2cce1787a99198f282dd8a26d1991449\"\u003e\u003ccode\u003e6b92ff5\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump tsx from 4.23.11 to 4.23.12 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/721\"\u003e#721\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/4f8983b9311d3d896e6bd8a3fb90cf4afde91b5c\"\u003e\u003ccode\u003e4f8983b\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump typescript-eslint from 8.65.0 to 8.67.0 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/719\"\u003e#719\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/10f27f499cc07de2496e6ec84c95f019fbbfe061\"\u003e\u003ccode\u003e10f27f4\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump eslint from 10.5.0 to 10.8.1 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/720\"\u003e#720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/249403a067afdb4dc73ece33bce948606f486da1\"\u003e\u003ccode\u003e249403a\u003c/code\u003e\u003c/a\u003e chore(deps-dev): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 26.1.0 to 26.2.0 (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/718\"\u003e#718\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/cbf8daab5ef08eec2b4849d40f2798fae7c50855\"\u003e\u003ccode\u003ecbf8daa\u003c/code\u003e\u003c/a\u003e chore(deps): bump anchore/workflows/.github/workflows/check-gate.yaml (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/693\"\u003e#693\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/anchore/sbom-action/commit/6afc7939587b28fc3a3cb96958223f88c7efa864\"\u003e\u003ccode\u003e6afc793\u003c/code\u003e\u003c/a\u003e fix: pin syft install.sh to the release tag being installed (\u003ca href=\"https://redirect.github.com/anchore/sbom-action/issues/716\"\u003e#716\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/anchore/sbom-action/compare/e22c389904149dbc22b58101806040fa8d37a610...3ad7283483fc7af8ff2b4ea19663c2d5ca935e26\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/attest-build-provenance` from 4.1.1 to 4.2.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/attest-build-provenance/releases\"\u003eactions/attest-build-provenance's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.2.2\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!NOTE]\nAs of version 4, \u003ccode\u003eactions/attest-build-provenance\u003c/code\u003e is simply a wrapper on top of \u003ca href=\"https://github.com/actions/attest\"\u003e\u003ccode\u003eactions/attest\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003eExisting applications may continue to use the \u003ccode\u003eattest-build-provenance\u003c/code\u003e action, but new implementations should use \u003ccode\u003eactions/attest\u003c/code\u003e instead.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/attest-build-provenance/pull/862\"\u003eactions/attest-build-provenance#862\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/attest-build-provenance/compare/v4.1.1...v4.2.2\"\u003ehttps://github.com/actions/attest-build-provenance/compare/v4.1.1...v4.2.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/attest-build-provenance/commit/4d101475d8b20a2381f78447822ac1eab6504dd8\"\u003e\u003ccode\u003e4d10147\u003c/code\u003e\u003c/a\u003e Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group (\u003ca href=\"https://redirect.github.com/actions/attest-build-provenance/issues/862\"\u003e#862\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/attest-build-provenance/commit/e3fe62ef559997059fe8380e7d2b4c909e2d65f4\"\u003e\u003ccode\u003ee3fe62e\u003c/code\u003e\u003c/a\u003e Bump the actions-minor group with 2 updates (\u003ca href=\"https://redirect.github.com/actions/attest-build-provenance/issues/860\"\u003e#860\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/attest-build-provenance/compare/0f67c3f4856b2e3261c31976d6725780e5e4c373...4d101475d8b20a2381f78447822ac1eab6504dd8\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `softprops/action-gh-release` from 3.0.1 to 3.0.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/softprops/action-gh-release/releases\"\u003esoftprops/action-gh-release's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.0.3\u003c/h2\u003e\n\u003cp\u003e\u003ccode\u003e3.0.3\u003c/code\u003e is a maintenance release with updated dependencies. It also safely\nclassifies malformed GitHub API errors to avoid secondary failures (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/822\"\u003e#822\u003c/a\u003e).\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eBug fixes 🐛\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: safely classify GitHub API errors by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/822\"\u003esoftprops/action-gh-release#822\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther Changes 🔄\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003edependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev3.0.2\u003c/h2\u003e\n\u003cp\u003e\u003ccode\u003e3.0.2\u003c/code\u003e is a patch release focused on release reliability and compatibility. It\nreuses existing draft releases when publishing prereleases, supports replacing\nrelease assets on Gitea, hardens streamed asset uploads, and provides clearer\nrelease-creation diagnostics. It also includes TypeScript, coverage, and tooling\nmaintenance merged since \u003ccode\u003e3.0.1\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis release fixes \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/795\"\u003e#795\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/438\"\u003e#438\u003c/a\u003e, and \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/803\"\u003e#803\u003c/a\u003e. The upload transport hardening covers the\nhistorical failure reported in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/790\"\u003e#790\u003c/a\u003e, although current hosted Node 24 runners did\nnot reproduce it naturally. The diagnostics work is related to \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/786\"\u003e#786\u003c/a\u003e and does not\nclaim a reproducible release-creation fix.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eExciting New Features 🎉\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efeat: improve release error reporting and test coverage by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/813\"\u003esoftprops/action-gh-release#813\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug fixes 🐛\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: publish existing draft releases as prereleases by \u003ca href=\"https://github.com/godfengliang\"\u003e\u003ccode\u003e@​godfengliang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/801\"\u003esoftprops/action-gh-release#801\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: upload small checksum assets reliably by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/815\"\u003esoftprops/action-gh-release#815\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: replace existing release assets on Gitea by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/816\"\u003esoftprops/action-gh-release#816\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: clarify release creation 404 errors by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/817\"\u003esoftprops/action-gh-release#817\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther Changes 🔄\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): upgrade TypeScript to 7 by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/812\"\u003esoftprops/action-gh-release#812\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): remove unused TypeScript tooling by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/814\"\u003esoftprops/action-gh-release#814\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edependency, Node 24 pin, and CI maintenance merged since \u003ccode\u003e3.0.1\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md\"\u003esoftprops/action-gh-release's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.0.3\u003c/h2\u003e\n\u003cp\u003e\u003ccode\u003e3.0.3\u003c/code\u003e is a maintenance release with updated dependencies. It also safely\nclassifies malformed GitHub API errors to avoid secondary failures (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/822\"\u003e#822\u003c/a\u003e).\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eBug fixes 🐛\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: safely classify GitHub API errors by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/822\"\u003esoftprops/action-gh-release#822\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther Changes 🔄\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003edependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.0.2\u003c/h2\u003e\n\u003cp\u003e\u003ccode\u003e3.0.2\u003c/code\u003e is a patch release focused on release reliability and compatibility. It\nreuses existing draft releases when publishing prereleases, supports replacing\nrelease assets on Gitea, hardens streamed asset uploads, and provides clearer\nrelease-creation diagnostics. It also includes TypeScript, coverage, and tooling\nmaintenance merged since \u003ccode\u003e3.0.1\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis release fixes \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/795\"\u003e#795\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/438\"\u003e#438\u003c/a\u003e, and \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/803\"\u003e#803\u003c/a\u003e. The upload transport hardening covers the\nhistorical failure reported in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/790\"\u003e#790\u003c/a\u003e, although current hosted Node 24 runners did\nnot reproduce it naturally. The diagnostics work is related to \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/786\"\u003e#786\u003c/a\u003e and does not\nclaim a reproducible release-creation fix.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eExciting New Features 🎉\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efeat: improve release error reporting and test coverage by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/813\"\u003esoftprops/action-gh-release#813\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug fixes 🐛\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: publish existing draft releases as prereleases by \u003ca href=\"https://github.com/godfengliang\"\u003e\u003ccode\u003e@​godfengliang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/801\"\u003esoftprops/action-gh-release#801\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: upload small checksum assets reliably by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/815\"\u003esoftprops/action-gh-release#815\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: replace existing release assets on Gitea by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/816\"\u003esoftprops/action-gh-release#816\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: clarify release creation 404 errors by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/817\"\u003esoftprops/action-gh-release#817\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther Changes 🔄\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): upgrade TypeScript to 7 by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/812\"\u003esoftprops/action-gh-release#812\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): remove unused TypeScript tooling by \u003ca href=\"https://github.com/chenrui333\"\u003e\u003ccode\u003e@​chenrui333\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/softprops/action-gh-release/pull/814\"\u003esoftprops/action-gh-release#814\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edependency, Node 24 pin, and CI maintenance merged since \u003ccode\u003e3.0.1\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003emaintenance release with updated dependencies\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/softprops/action-gh-release/commit/efb35369e0ad2afab669f228072c1b0d510eae64\"\u003e\u003ccode\u003eefb3536\u003c/code\u003e\u003c/a\u003e release 3.0.3 (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/840\"\u003e#840\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/softprops/action-gh-release/commit/6441963a7597ab67f36fea0287a7ae58a9bfd8fe\"\u003e\u003ccode\u003e6441963\u003c/code\u003e\u003c/a\u003e chore(deps): bump the npm group with 2 updates (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/839\"\u003e#839\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/softprops/action-gh-release/commit/e5ee6bc58a36b838b92fc1217f2e4b414b5abcc8\"\u003e\u003ccode\u003ee5ee6bc\u003c/code\u003e\u003c/a\u003e chore(deps): bump esbuild from 0.28.1 to 0.28.2 in the npm group (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/837\"\u003e#837\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/softprops/action-gh-release/commit/d1e66170d32c9ec7bbcb7fae044d3d686ce304d3\"\u003e\u003ccode\u003ed1e6617\u003c/code\u003e\u003c/a\u003e chore(deps): bump undici from 6.27.0 to 6.28.0 (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/831\"\u003e#831\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/softprops/action-gh-release/commit/64037519ba20f54c01bc1dc90342c929aac5a2fa\"\u003e\u003ccode\u003e6403751\u003c/code\u003e\u003c/a\u003e chore(deps): bump the npm group with 2 updates (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/835\"\u003e#835\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/softprops/action-gh-release/commit/7c7184b6876126a5df15adc5b679dc450a393725\"\u003e\u003ccode\u003e7c7184b\u003c/code\u003e\u003c/a\u003e chore(deps): bump postcss from 8.5.19 to 8.5.25 (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/833\"\u003e#833\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/softprops/action-gh-release/commit/0f3f0d2943676d58f9698b3ab590c2056023d77d\"\u003e\u003ccode\u003e0f3f0d2\u003c/code\u003e\u003c/a\u003e chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/832\"\u003e#832\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/softprops/action-gh-release/commit/77fb938f2f95e717ce6705d2909af527263360a0\"\u003e\u003ccode\u003e77fb938\u003c/code\u003e\u003c/a\u003e chore(deps): bump prettier from 3.9.5 to 3.9.6 in the npm group (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/830\"\u003e#830\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/softprops/action-gh-release/commit/5a6f51711ce2ba103b78f5e9550f810679f11e0e\"\u003e\u003ccode\u003e5a6f517\u003c/code\u003e\u003c/a\u003e chore(deps): bump brace-expansion from 5.0.7 to 5.0.8 (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/828\"\u003e#828\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/softprops/action-gh-release/commit/a3c91c98f80000f5b06c7fc0327c54f51c6ab7d8\"\u003e\u003ccode\u003ea3c91c9\u003c/code\u003e\u003c/a\u003e chore(deps): bump the github-actions group with 2 updates (\u003ca href=\"https://redirect.github.com/softprops/action-gh-release/issues/825\"\u003e#825\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/softprops/action-gh-release/compare/718ea10b132b3b2eba29c1007bb80653f286566b...efb35369e0ad2afab669f228072c1b0d510eae64\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action` from 2.3.8 to 2.5.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.1\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions/checkout action to v7 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/133\"\u003egoogle/osv-scanner-action#133\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve package namespaces when querying osv.dev API (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2978\"\u003e#2978\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eRe-add support for the \u003ccode\u003eOSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY\u003c/code\u003e environment variable (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2983\"\u003e#2983\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eFix local vulnerability matching (\u003ccode\u003e--offline-vulnerabilities\u003c/code\u003e) not working when network capability is \u003ccode\u003eNetworkOnline\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.5.0 as well as:\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: gate reusable workflow outputs with a flag by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/130\"\u003egoogle/osv-scanner-action#130\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin download-artifact action to SHA by \u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add runs-on input to reusable workflows by \u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: address zizmor warnings by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/135\"\u003egoogle/osv-scanner-action#135\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: add GOTOOLCHAIN=auto env to osv-scanner calls by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/138\"\u003egoogle/osv-scanner-action#138\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/6e4298ebc4db23e847df9b2e2de2939d6f066c67\"\u003e\u003ccode\u003e6e4298e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/141\"\u003e#141\u003c/a\u003e from google/update-to-v2.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/5957b4e7a8725730a37d973099c16b9fe44cfc5f\"\u003e\u003ccode\u003e5957b4e\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.1 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/880d9b542cc66d36d91d51b3fbcc038f5f28cfc5\"\u003e\u003ccode\u003e880d9b5\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.1 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/baa4139e56d6312335d899e6ba045fa16d1d3d0b\"\u003e\u003ccode\u003ebaa4139\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.5.1 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f4cfcc01edc9c8b756a9b873b7a623ca674da51e\"\u003e\u003ccode\u003ef4cfcc0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/117\"\u003e#117\u003c/a\u003e from renovate-bot/renovate/workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dfd4cd1d0114e5fc71a6862faf1114ed69d9dca7\"\u003e\u003ccode\u003edfd4cd1\u003c/code\u003e\u003c/a\u003e Update workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/e13f842f8f0b5845b610f16e8a2eb7f22a7f8677\"\u003e\u003ccode\u003ee13f842\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/133\"\u003e#133\u003c/a\u003e from renovate-bot/renovate/major-workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8deb546fdb875b9996d27d4950be7312dac076a1\"\u003e\u003ccode\u003e8deb546\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/140\"\u003e#140\u003c/a\u003e from google/update-to-v2.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8fb3f8c89519ea2c868d3277441ee7fd3c7f15af\"\u003e\u003ccode\u003e8fb3f8c\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.0 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/0c58c542420dfd23fcac08dd9c8ca3cca9c36f1a\"\u003e\u003ccode\u003e0c58c54\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.0 actions\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ossf/scorecard-action` from 2.4.3 to 2.4.4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ossf/scorecard-action/releases\"\u003eossf/scorecard-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.4.4\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the \u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.4.0\"\u003eScorecard v5.4.0 release notes\u003c/a\u003e and the \u003ca href=\"https://github.com/ossf/scorecard/releases/tag/v5.5.0\"\u003eScorecard v5.5.0 release notes\u003c/a\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003elog POST failures instead of failing entire action by \u003ca href=\"https://github.com/spencerschrock\"\u003e\u003ccode\u003e@​spencerschrock\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ossf/scorecard-action/pull/1625\"\u003eossf/scorecard-action#1625\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.3...v2.4.4\"\u003ehttps://github.com/ossf/scorecard-action/compare/v2.4.3...v2.4.4\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/2d1146689b8cda280b9bc96326124645441f03bc\"\u003e\u003ccode\u003e2d11466\u003c/code\u003e\u003c/a\u003e Bump action tag for v2.4.4 release (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1688\"\u003e#1688\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/1bd3285473b114fb77ed934c4ba0aea31aa0f866\"\u003e\u003ccode\u003e1bd3285\u003c/code\u003e\u003c/a\u003e :seedling: Bump the docker-images group across 1 directory with 2 updates (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1\"\u003e#1\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/913edce4c1ce57261797e2ddcb74e493d9ce9700\"\u003e\u003ccode\u003e913edce\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/containerd/containerd from 1.7.32 to 1.7.33 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1671\"\u003e#1671\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/0957b8f1c327cafd868bd6bdb7e441c016628783\"\u003e\u003ccode\u003e0957b8f\u003c/code\u003e\u003c/a\u003e :seedling: Bump golang.org/x/net from 0.56.0 to 0.57.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1680\"\u003e#1680\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/f0061eb3ff8c4d311e47276c8bcc96e96ed5dc32\"\u003e\u003ccode\u003ef0061eb\u003c/code\u003e\u003c/a\u003e :seedling: Bump google.golang.org/grpc from 1.81.1 to 1.82.1 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1687\"\u003e#1687\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/20ee7324026c52f8d0c4b372a7bf382a01b72ff9\"\u003e\u003ccode\u003e20ee732\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1685\"\u003e#1685\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/9f295ef01b1f77f15b1647c790db825d9577a441\"\u003e\u003ccode\u003e9f295ef\u003c/code\u003e\u003c/a\u003e :seedling: Bump the github-actions group with 6 updates (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1686\"\u003e#1686\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/69bf556cea38c0fbe034b2ce923253eca7c4d651\"\u003e\u003ccode\u003e69bf556\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.0 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1681\"\u003e#1681\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/94e8b9600123b21167ebf56077904fc6ca421a95\"\u003e\u003ccode\u003e94e8b96\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/rekor from 1.5.0 to 1.5.2 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1673\"\u003e#1673\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ossf/scorecard-action/commit/c7a1b37bbc88c32d53056d9071ce2ba0df381dfb\"\u003e\u003ccode\u003ec7a1b37\u003c/code\u003e\u003c/a\u003e :seedling: Bump github.com/sigstore/fulcio from 1.8.5 to 1.8.6 (\u003ca href=\"https://redirect.github.com/ossf/scorecard-action/issues/1675\"\u003e#1675\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/ossf/scorecard-action/compare/v2.4.3...v2.4.4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/cofob/codex-start/pull/21","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/cofob%2Fcodex-start/issues/21","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/21/packages"}},{"old_version":"2.5.0","new_version":"2.5.1","update_type":"patch","path":null,"pr_created_at":"2026-09-04T14:18:03.000Z","version_change":"2.5.0 → 2.5.1","issue":{"uuid":"5349184932","node_id":"PR_kwDOSeiTmc8AAAABCNiMRQ","number":213,"state":"closed","title":"chore(deps): bump the images-minor group with 2 updates","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-09-04T14:36:23.000Z","author_association":null,"state_reason":null,"created_at":"2026-09-04T14:18:03.000Z","updated_at":"2026-09-04T14:36:25.000Z","time_to_close":1100,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"images-minor","update_count":2,"packages":[{"name":"google/osv-scanner-action","old_version":"2.5.0","new_version":"2.5.1","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"github/codeql-action","old_version":"4.37.8","new_version":"4.37.9","repository_url":"https://github.com/github/codeql-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the images-minor group with 2 updates: [google/osv-scanner-action](https://github.com/google/osv-scanner-action) and [github/codeql-action](https://github.com/github/codeql-action).\n\nUpdates `google/osv-scanner-action` from 2.5.0 to 2.5.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.1\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions/checkout action to v7 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/133\"\u003egoogle/osv-scanner-action#133\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve package namespaces when querying osv.dev API (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2978\"\u003e#2978\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eRe-add support for the \u003ccode\u003eOSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY\u003c/code\u003e environment variable (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2983\"\u003e#2983\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eFix local vulnerability matching (\u003ccode\u003e--offline-vulnerabilities\u003c/code\u003e) not working when network capability is \u003ccode\u003eNetworkOnline\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/6e4298ebc4db23e847df9b2e2de2939d6f066c67\"\u003e\u003ccode\u003e6e4298e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/141\"\u003e#141\u003c/a\u003e from google/update-to-v2.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/5957b4e7a8725730a37d973099c16b9fe44cfc5f\"\u003e\u003ccode\u003e5957b4e\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.1 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/880d9b542cc66d36d91d51b3fbcc038f5f28cfc5\"\u003e\u003ccode\u003e880d9b5\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.1 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/baa4139e56d6312335d899e6ba045fa16d1d3d0b\"\u003e\u003ccode\u003ebaa4139\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.5.1 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f4cfcc01edc9c8b756a9b873b7a623ca674da51e\"\u003e\u003ccode\u003ef4cfcc0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/117\"\u003e#117\u003c/a\u003e from renovate-bot/renovate/workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dfd4cd1d0114e5fc71a6862faf1114ed69d9dca7\"\u003e\u003ccode\u003edfd4cd1\u003c/code\u003e\u003c/a\u003e Update workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/e13f842f8f0b5845b610f16e8a2eb7f22a7f8677\"\u003e\u003ccode\u003ee13f842\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/133\"\u003e#133\u003c/a\u003e from renovate-bot/renovate/major-workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3f2e7fe5a8528de51a596a4c89dd68e977012c5d\"\u003e\u003ccode\u003e3f2e7fe\u003c/code\u003e\u003c/a\u003e Update actions/checkout action to v7\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action` from 4.37.8 to 4.37.9\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.37.9\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/cdf488f595d80d6e07e03d4674febd5ab45fa938\"\u003e\u003ccode\u003ecdf488f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4107\"\u003e#4107\u003c/a\u003e from github/update-v4.37.9-920ba7cd1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7243f38558d187dde99730d224bb47aa26a95306\"\u003e\u003ccode\u003e7243f38\u003c/code\u003e\u003c/a\u003e Update changelog for v4.37.9\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/920ba7cd1596037e042122c00381eb16b397d68e\"\u003e\u003ccode\u003e920ba7c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4106\"\u003e#4106\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ecfa6e16817b8f490bc9a59baa391baf4fa3e3c2\"\u003e\u003ccode\u003eecfa6e1\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/adcdf4a70d247343cf9c29e0f7a6658b51c3a2b1\"\u003e\u003ccode\u003eadcdf4a\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/486fec2a3ea2626afcd8c7e9208b4f515078dd7e\"\u003e\u003ccode\u003e486fec2\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4099\"\u003e#4099\u003c/a\u003e from github/update-supported-enterprise-server-versions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/134624c67b20869c2aaa36dafa726375b78a5d76\"\u003e\u003ccode\u003e134624c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4101\"\u003e#4101\u003c/a\u003e from github/dependabot/npm_and_yarn/npm-minor-457d82...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ff43db8f982a368288f117354fb8d046e937124c\"\u003e\u003ccode\u003eff43db8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4103\"\u003e#4103\u003c/a\u003e from github/mergeback/v4.37.8-to-main-db488dde\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4605e03a74cf891614c4d76f82384a16c1c11816\"\u003e\u003ccode\u003e4605e03\u003c/code\u003e\u003c/a\u003e Rebuild\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/099c869cad6bf3b88657154d4ae47ffed27e632d\"\u003e\u003ccode\u003e099c869\u003c/code\u003e\u003c/a\u003e Update changelog and version after v4.37.8\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/v4.37.8...v4.37.9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/livewyer-ops/tamoss/pull/213","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/livewyer-ops%2Ftamoss/issues/213","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/213/packages"}},{"old_version":"2.3.8","new_version":"2.5.1","update_type":"minor","path":null,"pr_created_at":"2026-09-02T13:56:34.000Z","version_change":"2.3.8 → 2.5.1","issue":{"uuid":"5324858056","node_id":"PR_kwDOS0rmRM8AAAABB6GCEA","number":194,"state":"closed","title":"Bump the actions group across 1 directory with 5 updates","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-09-04T13:56:19.000Z","author_association":null,"state_reason":null,"created_at":"2026-09-02T13:56:34.000Z","updated_at":"2026-09-04T13:56:21.000Z","time_to_close":172785,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","group_name":"actions","update_count":5,"packages":[{"name":"actions/setup-java","old_version":"5","new_version":"6","repository_url":"https://github.com/actions/setup-java"},{"name":"actions/configure-pages","old_version":"5","new_version":"6","repository_url":"https://github.com/actions/configure-pages"},{"name":"actions/upload-pages-artifact","old_version":"4","new_version":"5","repository_url":"https://github.com/actions/upload-pages-artifact"},{"name":"github/codeql-action","old_version":"4.37.3","new_version":"4.37.9","repository_url":"https://github.com/github/codeql-action"},{"name":"google/osv-scanner-action","old_version":"2.3.8","new_version":"2.5.1","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the actions group with 5 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/setup-java](https://github.com/actions/setup-java) | `5` | `6` |\n| [actions/configure-pages](https://github.com/actions/configure-pages) | `5` | `6` |\n| [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) | `4` | `5` |\n| [github/codeql-action](https://github.com/github/codeql-action) | `4.37.3` | `4.37.9` |\n| [google/osv-scanner-action](https://github.com/google/osv-scanner-action) | `2.3.8` | `2.5.1` |\n\n\nUpdates `actions/setup-java` from 5 to 6\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/setup-java/releases\"\u003eactions/setup-java's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edist: Migrate from Zulu Discovery API to Azul Metadata API by \u003ca href=\"https://github.com/jameswald\"\u003e\u003ccode\u003e@​jameswald\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1010\"\u003eactions/setup-java#1010\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add .mvn/extensions.xml to Maven cache key pattern by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1041\"\u003eactions/setup-java#1041\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMigrate to ESM and upgrade dependencies by \u003ca href=\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1078\"\u003eactions/setup-java#1078\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMap Zulu x86 architecture to i686 for Azul Metadata API by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1079\"\u003eactions/setup-java#1079\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRename jdkFile input to jdk-file with deprecated alias by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1083\"\u003eactions/setup-java#1083\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eInfer distribution from asdf .tool-versions vendor prefix by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1084\"\u003eactions/setup-java#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd Maven compiler problem matcher for javac diagnostics by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1086\"\u003eactions/setup-java#1086\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: expose cache-primary-key output (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/597\"\u003e#597\u003c/a\u003e) by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1088\"\u003eactions/setup-java#1088\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: clarify V6 ESM migration is not a user-facing breaking change by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1090\"\u003eactions/setup-java#1090\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport multi-field Java versions like \u003ccode\u003e18.0.1.1\u003c/code\u003e by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1092\"\u003eactions/setup-java#1092\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: document seeding the Maven cache for plugin dependencies by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1094\"\u003eactions/setup-java#1094\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: clarify Maven cache paths and key hash inputs by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1096\"\u003eactions/setup-java#1096\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport pinning java-version as \u0026quot;latest\u0026quot; by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1093\"\u003eactions/setup-java#1093\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump eslint from 10.6.0 to 10.7.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1101\"\u003eactions/setup-java#1101\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump eslint-plugin-n from 18.2.1 to 18.2.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1103\"\u003eactions/setup-java#1103\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump prettier from 3.9.4 to 3.9.5 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1105\"\u003eactions/setup-java#1105\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump actions/checkout from 6 to 7 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1106\"\u003eactions/setup-java#1106\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 26.1.0 to 26.1.1 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1104\"\u003eactions/setup-java#1104\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edist: Cover Tencent Kona JDK 25 by \u003ca href=\"https://github.com/johnshajiang\"\u003e\u003ccode\u003e@​johnshajiang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1108\"\u003eactions/setup-java#1108\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1102\"\u003eactions/setup-java#1102\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePreserve Maven toolchains across repeated setup-java runs (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1099\"\u003e#1099\u003c/a\u003e) by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1111\"\u003eactions/setup-java#1111\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edist: Support Liberica NIK (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/878\"\u003e#878\u003c/a\u003e) by \u003ca href=\"https://github.com/asm0dey\"\u003e\u003ccode\u003e@​asm0dey\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1112\"\u003eactions/setup-java#1112\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix template injection (zizmor alert \u003ca href=\"https://redirect.github.com/actions/setup-java/issues/118\"\u003e#118\u003c/a\u003e) in e2e-versions.yml by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1114\"\u003eactions/setup-java#1114\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix template injection in e2e-versions.yml (zizmor alert \u003ca href=\"https://redirect.github.com/actions/setup-java/issues/122\"\u003e#122\u003c/a\u003e) by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1120\"\u003eactions/setup-java#1120\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDisable persisted checkout credentials in e2e workflow by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1115\"\u003eactions/setup-java#1115\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: Update recommended configuration for GPG signing by \u003ca href=\"https://github.com/wetneb\"\u003e\u003ccode\u003e@​wetneb\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/608\"\u003eactions/setup-java#608\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCache Maven and Gradle wrapper distributions separately from the dependency cache by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1097\"\u003eactions/setup-java#1097\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConsolidate cache-dependency-path e2e workflow and add maven/sbt coverage by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1124\"\u003eactions/setup-java#1124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUse gpg.passphraseEnvName instead of the deprecated gpg.passphrase server by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1123\"\u003eactions/setup-java#1123\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExtract repeated directory-check assertions into check-dir.sh helper by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1127\"\u003eactions/setup-java#1127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConsolidate duplicate jobs in e2e-versions workflow by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1125\"\u003eactions/setup-java#1125\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUse YAML anchors to reduce boilerplate in e2e-versions workflow by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1126\"\u003eactions/setup-java#1126\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdated msft json for now by \u003ca href=\"https://github.com/jmjaffe37\"\u003e\u003ccode\u003e@​jmjaffe37\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1129\"\u003eactions/setup-java#1129\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument missing action inputs in README by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1130\"\u003eactions/setup-java#1130\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 by \u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1128\"\u003eactions/setup-java#1128\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd an option to disable Java problem matchers by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1133\"\u003eactions/setup-java#1133\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: update setup-java examples by \u003ca href=\"https://github.com/HarithaVattikuti\"\u003e\u003ccode\u003e@​HarithaVattikuti\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1131\"\u003eactions/setup-java#1131\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eClarify credential environment variable inputs by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1134\"\u003eactions/setup-java#1134\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump \u003ccode\u003e@​typescript-eslint/eslint-plugin\u003c/code\u003e from 8.63.0 to 8.64.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1135\"\u003eactions/setup-java#1135\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump actions/setup-python from 6 to 7 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1143\"\u003eactions/setup-java#1143\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump fast-xml-parser from 5.9.3 to 5.10.1 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1142\"\u003eactions/setup-java#1142\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e from 8.64.0 to 8.65.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1138\"\u003eactions/setup-java#1138\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump lint-staged from 17.0.8 to 17.2.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1136\"\u003eactions/setup-java#1136\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1137\"\u003eactions/setup-java#1137\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): fix npm audited vulnerabilities by \u003ca href=\"https://github.com/mhoffrog\"\u003e\u003ccode\u003e@​mhoffrog\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1140\"\u003eactions/setup-java#1140\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix formatting issues in README.md by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1144\"\u003eactions/setup-java#1144\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemediate npm audit findings and rebuild distributions by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1145\"\u003eactions/setup-java#1145\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSet GRAALVM_HOME for GraalVM distributions by \u003ca href=\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e with \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-java/pull/1146\"\u003eactions/setup-java#1146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-java/commit/dd06d9cba3e5552c54d9f8ea23572deb30010f7c\"\u003e\u003ccode\u003edd06d9c\u003c/code\u003e\u003c/a\u003e Prepare documentation for v6 release (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1253\"\u003e#1253\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-java/commit/59b3450628e54f250d3a3bfd413cd68b83bce8ed\"\u003e\u003ccode\u003e59b3450\u003c/code\u003e\u003c/a\u003e chore(deps): combine open Dependabot npm updates (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1252\"\u003e#1252\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-java/commit/b96213d9d21fbd1dd447987fe15dd75fce7f7726\"\u003e\u003ccode\u003eb96213d\u003c/code\u003e\u003c/a\u003e Set default signature verification for supported distributions (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1246\"\u003e#1246\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-java/commit/1dbac3c9e137b6d4d280bae1ae4e9902bb4ce1b9\"\u003e\u003ccode\u003e1dbac3c\u003c/code\u003e\u003c/a\u003e docs: expose contributing guide to GitHub (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1245\"\u003e#1245\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-java/commit/11741d6cfaf82354eb314633583a9ce43399238b\"\u003e\u003ccode\u003e11741d6\u003c/code\u003e\u003c/a\u003e ci: constrain cache e2e job modes (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1244\"\u003e#1244\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-java/commit/ff99aa1c87709f29685194226dae7d9b476c594f\"\u003e\u003ccode\u003eff99aa1\u003c/code\u003e\u003c/a\u003e Fix Oracle macOS E2E version (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1243\"\u003e#1243\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-java/commit/416c6d1e8ab4ffb67a533d502fd7b21f70c5d9ee\"\u003e\u003ccode\u003e416c6d1\u003c/code\u003e\u003c/a\u003e Add Red Hat Build of OpenJDK support (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1241\"\u003e#1241\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-java/commit/5f75b27283990add95cd9c4ceaca74d789324bf7\"\u003e\u003ccode\u003e5f75b27\u003c/code\u003e\u003c/a\u003e Add Maven dependency-resolution repositories (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1240\"\u003e#1240\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-java/commit/a42a52cfb590b0682db41c911da5dc7798ba620e\"\u003e\u003ccode\u003ea42a52c\u003c/code\u003e\u003c/a\u003e Add multiple Maven server credentials (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1239\"\u003e#1239\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-java/commit/fb4abd7a7075173ac733c41f723ac0c47c41ad17\"\u003e\u003ccode\u003efb4abd7\u003c/code\u003e\u003c/a\u003e test: cover JDK 26 from SDKMAN (\u003ca href=\"https://redirect.github.com/actions/setup-java/issues/1238\"\u003e#1238\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/setup-java/compare/v5...v6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/configure-pages` from 5 to 6\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/configure-pages/releases\"\u003eactions/configure-pages's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eupgrade to node 24 \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/186\"\u003e#186\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpgrade IA Publish \u003ca href=\"https://github.com/Jcambass\"\u003e\u003ccode\u003e@​Jcambass\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/165\"\u003e#165\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd workflow file for publishing releases to immutable action package \u003ca href=\"https://github.com/Jcambass\"\u003e\u003ccode\u003e@​Jcambass\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/163\"\u003e#163\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003epin draft release version \u003ca href=\"https://github.com/YiMysty\"\u003e\u003ccode\u003e@​YiMysty\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/162\"\u003e#162\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump espree from 9.6.1 to 10.1.0 \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/160\"\u003e#160\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump eslint-config-prettier from 8.8.0 to 9.1.0 \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/143\"\u003e#143\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBe more friendly to Dependabot \u003ca href=\"https://github.com/yoannchaudet\"\u003e\u003ccode\u003e@​yoannchaudet\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/158\"\u003e#158\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump eslint-plugin-github from 4.10.2 to 5.0.1 \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/154\"\u003e#154\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump braces from 3.0.2 to 3.0.3 in the npm_and_yarn group \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/156\"\u003e#156\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump undici from 5.28.3 to 5.28.4 \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/145\"\u003e#145\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSee details of \u003ca href=\"https://github.com/actions/configure-pages/compare/v5.0.0...v5.0.1\"\u003eall code changes\u003c/a\u003e since previous release.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/45bfe0192ca1faeb007ade9deae92b16b8254a0d\"\u003e\u003ccode\u003e45bfe01\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/186\"\u003e#186\u003c/a\u003e from salmanmkc/node24\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/d8770c2b3b71963902cec525cf516368b4411a78\"\u003e\u003ccode\u003ed8770c2\u003c/code\u003e\u003c/a\u003e Update Node version from 20 to 24 in action.yml\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/cb8a1a32801e6cdb7b111ce13761226bba88f67d\"\u003e\u003ccode\u003ecb8a1a3\u003c/code\u003e\u003c/a\u003e upgrade to node 24\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/d5606572c479bee637007364c6b4800ac4fc8573\"\u003e\u003ccode\u003ed560657\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/165\"\u003e#165\u003c/a\u003e from actions/Jcambass-patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/35e0ac4e4038e070ce9da26f41143bc3cf3c7e1d\"\u003e\u003ccode\u003e35e0ac4\u003c/code\u003e\u003c/a\u003e Upgrade IA Publish\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/1dfbcbff6519463927204dc279c2e0d307824ee2\"\u003e\u003ccode\u003e1dfbcbf\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/163\"\u003e#163\u003c/a\u003e from actions/Jcambass-patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/2f4f988792f75a5edcc39df0e1661f78999e0348\"\u003e\u003ccode\u003e2f4f988\u003c/code\u003e\u003c/a\u003e Add workflow file for publishing releases to immutable action package\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/0d7570ca8762e8c951911e8c9655d8973cc93174\"\u003e\u003ccode\u003e0d7570c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/162\"\u003e#162\u003c/a\u003e from actions/pin-draft-release-verssion\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/3ea19669a5cd11c46d23d6578d088b81fe8527e5\"\u003e\u003ccode\u003e3ea1966\u003c/code\u003e\u003c/a\u003e pin draft release version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/configure-pages/commit/aabcbc432d6b06d1fd5e8bf3cf756880c35e014d\"\u003e\u003ccode\u003eaabcbc4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/configure-pages/issues/160\"\u003e#160\u003c/a\u003e from actions/dependabot/npm_and_yarn/espree-10.1.0\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/configure-pages/compare/v5...v6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/upload-pages-artifact` from 4 to 5\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/upload-pages-artifact/releases\"\u003eactions/upload-pages-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate upload-artifact action to version 7 \u003ca href=\"https://github.com/Tom-van-Woudenberg\"\u003e\u003ccode\u003e@​Tom-van-Woudenberg\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/issues/139\"\u003e#139\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efeat: add \u003ccode\u003einclude-hidden-files\u003c/code\u003e input \u003ca href=\"https://github.com/jonchurch\"\u003e\u003ccode\u003e@​jonchurch\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/issues/137\"\u003e#137\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSee details of \u003ca href=\"https://github.com/actions/upload-pages-artifact/compare/v4.0.0...v4.0.1\"\u003eall code changes\u003c/a\u003e since previous release.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/fc324d3547104276b827a68afc52ff2a11cc49c9\"\u003e\u003ccode\u003efc324d3\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/issues/139\"\u003e#139\u003c/a\u003e from Tom-van-Woudenberg/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/fe9d4b7d84090e1d8d9c53a0236f810d4e00d2c3\"\u003e\u003ccode\u003efe9d4b7\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/0ca16172ca884f0a37117fed41734f29784cc980\"\u003e\u003ccode\u003e0ca1617\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-pages-artifact/issues/137\"\u003e#137\u003c/a\u003e from jonchurch/include-hidden-files\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/57f0e8492b437b7818227931fef2faa1a379839b\"\u003e\u003ccode\u003e57f0e84\u003c/code\u003e\u003c/a\u003e Update action.yml\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/4a90348b2933470dc78cec55534259872a6d3c0d\"\u003e\u003ccode\u003e4a90348\u003c/code\u003e\u003c/a\u003e v7 --\u0026gt; hash\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/56f665a6f297fa95f8d735b314187fb2d7764569\"\u003e\u003ccode\u003e56f665a\u003c/code\u003e\u003c/a\u003e Update upload-artifact action to version 7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-pages-artifact/commit/f7615f5917213b24245d49ba96693d0f5375a414\"\u003e\u003ccode\u003ef7615f5\u003c/code\u003e\u003c/a\u003e Add \u003ccode\u003einclude-hidden-files\u003c/code\u003e input\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/upload-pages-artifact/compare/v4...v5\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action` from 4.37.3 to 4.37.9\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.37.9\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.8\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.37.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.6\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.5 - 03 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.4 - 29 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/cdf488f595d80d6e07e03d4674febd5ab45fa938\"\u003e\u003ccode\u003ecdf488f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4107\"\u003e#4107\u003c/a\u003e from github/update-v4.37.9-920ba7cd1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7243f38558d187dde99730d224bb47aa26a95306\"\u003e\u003ccode\u003e7243f38\u003c/code\u003e\u003c/a\u003e Update changelog for v4.37.9\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/920ba7cd1596037e042122c00381eb16b397d68e\"\u003e\u003ccode\u003e920ba7c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4106\"\u003e#4106\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ecfa6e16817b8f490bc9a59baa391baf4fa3e3c2\"\u003e\u003ccode\u003eecfa6e1\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/adcdf4a70d247343cf9c29e0f7a6658b51c3a2b1\"\u003e\u003ccode\u003eadcdf4a\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/486fec2a3ea2626afcd8c7e9208b4f515078dd7e\"\u003e\u003ccode\u003e486fec2\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4099\"\u003e#4099\u003c/a\u003e from github/update-supported-enterprise-server-versions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/134624c67b20869c2aaa36dafa726375b78a5d76\"\u003e\u003ccode\u003e134624c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4101\"\u003e#4101\u003c/a\u003e from github/dependabot/npm_and_yarn/npm-minor-457d82...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ff43db8f982a368288f117354fb8d046e937124c\"\u003e\u003ccode\u003eff43db8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4103\"\u003e#4103\u003c/a\u003e from github/mergeback/v4.37.8-to-main-db488dde\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4605e03a74cf891614c4d76f82384a16c1c11816\"\u003e\u003ccode\u003e4605e03\u003c/code\u003e\u003c/a\u003e Rebuild\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/099c869cad6bf3b88657154d4ae47ffed27e632d\"\u003e\u003ccode\u003e099c869\u003c/code\u003e\u003c/a\u003e Update changelog and version after v4.37.8\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/v4.37.3...v4.37.9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action` from 2.3.8 to 2.5.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.1\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions/checkout action to v7 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/133\"\u003egoogle/osv-scanner-action#133\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve package namespaces when querying osv.dev API (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2978\"\u003e#2978\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eRe-add support for the \u003ccode\u003eOSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY\u003c/code\u003e environment variable (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2983\"\u003e#2983\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eFix local vulnerability matching (\u003ccode\u003e--offline-vulnerabilities\u003c/code\u003e) not working when network capability is \u003ccode\u003eNetworkOnline\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.5.0 as well as:\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: gate reusable workflow outputs with a flag by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/130\"\u003egoogle/osv-scanner-action#130\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin download-artifact action to SHA by \u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add runs-on input to reusable workflows by \u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: address zizmor warnings by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/135\"\u003egoogle/osv-scanner-action#135\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: add GOTOOLCHAIN=auto env to osv-scanner calls by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/138\"\u003egoogle/osv-scanner-action#138\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/6e4298ebc4db23e847df9b2e2de2939d6f066c67\"\u003e\u003ccode\u003e6e4298e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/141\"\u003e#141\u003c/a\u003e from google/update-to-v2.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/5957b4e7a8725730a37d973099c16b9fe44cfc5f\"\u003e\u003ccode\u003e5957b4e\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.1 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/880d9b542cc66d36d91d51b3fbcc038f5f28cfc5\"\u003e\u003ccode\u003e880d9b5\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.1 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/baa4139e56d6312335d899e6ba045fa16d1d3d0b\"\u003e\u003ccode\u003ebaa4139\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.5.1 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f4cfcc01edc9c8b756a9b873b7a623ca674da51e\"\u003e\u003ccode\u003ef4cfcc0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/117\"\u003e#117\u003c/a\u003e from renovate-bot/renovate/workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dfd4cd1d0114e5fc71a6862faf1114ed69d9dca7\"\u003e\u003ccode\u003edfd4cd1\u003c/code\u003e\u003c/a\u003e Update workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/e13f842f8f0b5845b610f16e8a2eb7f22a7f8677\"\u003e\u003ccode\u003ee13f842\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/133\"\u003e#133\u003c/a\u003e from renovate-bot/renovate/major-workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8deb546fdb875b9996d27d4950be7312dac076a1\"\u003e\u003ccode\u003e8deb546\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/140\"\u003e#140\u003c/a\u003e from google/update-to-v2.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8fb3f8c89519ea2c868d3277441ee7fd3c7f15af\"\u003e\u003ccode\u003e8fb3f8c\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.0 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/0c58c542420dfd23fcac08dd9c8ca3cca9c36f1a\"\u003e\u003ccode\u003e0c58c54\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.0 actions\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/SelfishCoconut/pictokeyboard/pull/194","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/SelfishCoconut%2Fpictokeyboard/issues/194","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/194/packages"}},{"old_version":"2.3.5","new_version":"2.5.1","update_type":"minor","path":null,"pr_created_at":"2026-09-02T01:47:34.000Z","version_change":"2.3.5 → 2.5.1","issue":{"uuid":"5318745897","node_id":"PR_kwDOPaeG-M8AAAABB1OtpA","number":93,"state":"open","title":"chore(ci): bump google/osv-scanner-action from 2.3.5 to 2.5.1","user":"dependabot[bot]","labels":["dependencies","github-actions","configuration","ci","dependabot"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-09-02T01:47:34.000Z","updated_at":"2026-09-02T01:48:21.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(ci)","packages":[{"name":"google/osv-scanner-action","old_version":"2.3.5","new_version":"2.5.1","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [google/osv-scanner-action](https://github.com/google/osv-scanner-action) from 2.3.5 to 2.5.1.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.1\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions/checkout action to v7 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/133\"\u003egoogle/osv-scanner-action#133\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve package namespaces when querying osv.dev API (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2978\"\u003e#2978\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eRe-add support for the \u003ccode\u003eOSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY\u003c/code\u003e environment variable (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2983\"\u003e#2983\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eFix local vulnerability matching (\u003ccode\u003e--offline-vulnerabilities\u003c/code\u003e) not working when network capability is \u003ccode\u003eNetworkOnline\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.5.0 as well as:\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: gate reusable workflow outputs with a flag by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/130\"\u003egoogle/osv-scanner-action#130\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin download-artifact action to SHA by \u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add runs-on input to reusable workflows by \u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: address zizmor warnings by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/135\"\u003egoogle/osv-scanner-action#135\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: add GOTOOLCHAIN=auto env to osv-scanner calls by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/138\"\u003egoogle/osv-scanner-action#138\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/6e4298ebc4db23e847df9b2e2de2939d6f066c67\"\u003e\u003ccode\u003e6e4298e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/141\"\u003e#141\u003c/a\u003e from google/update-to-v2.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/5957b4e7a8725730a37d973099c16b9fe44cfc5f\"\u003e\u003ccode\u003e5957b4e\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.1 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/880d9b542cc66d36d91d51b3fbcc038f5f28cfc5\"\u003e\u003ccode\u003e880d9b5\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.1 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/baa4139e56d6312335d899e6ba045fa16d1d3d0b\"\u003e\u003ccode\u003ebaa4139\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.5.1 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f4cfcc01edc9c8b756a9b873b7a623ca674da51e\"\u003e\u003ccode\u003ef4cfcc0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/117\"\u003e#117\u003c/a\u003e from renovate-bot/renovate/workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dfd4cd1d0114e5fc71a6862faf1114ed69d9dca7\"\u003e\u003ccode\u003edfd4cd1\u003c/code\u003e\u003c/a\u003e Update workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/e13f842f8f0b5845b610f16e8a2eb7f22a7f8677\"\u003e\u003ccode\u003ee13f842\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/133\"\u003e#133\u003c/a\u003e from renovate-bot/renovate/major-workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8deb546fdb875b9996d27d4950be7312dac076a1\"\u003e\u003ccode\u003e8deb546\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/140\"\u003e#140\u003c/a\u003e from google/update-to-v2.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8fb3f8c89519ea2c868d3277441ee7fd3c7f15af\"\u003e\u003ccode\u003e8fb3f8c\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.0 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/0c58c542420dfd23fcac08dd9c8ca3cca9c36f1a\"\u003e\u003ccode\u003e0c58c54\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.0 actions\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.5.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google/osv-scanner-action\u0026package-manager=github_actions\u0026previous-version=2.3.5\u0026new-version=2.5.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/bauer-group/automation-templates/pull/93","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/bauer-group%2Fautomation-templates/issues/93","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/93/packages"}},{"old_version":"2.3.8","new_version":"2.5.1","update_type":"minor","path":null,"pr_created_at":"2026-08-31T08:16:40.000Z","version_change":"2.3.8 → 2.5.1","issue":{"uuid":"5298011685","node_id":"PR_kwDOSwL1Vc8AAAABBkpuBw","number":33,"state":"open","title":"chore(deps): bump the all group across 1 directory with 13 updates","user":"dependabot[bot]","labels":["dependencies","github_actions","Workflows / CI"],"assignees":[],"locked":false,"comments_count":9,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-08-31T08:16:40.000Z","updated_at":"2026-09-07T08:15:31.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"all","update_count":13,"packages":[{"name":"actions/checkout","old_version":"4","new_version":"7","repository_url":"https://github.com/actions/checkout"},{"name":"codecov/codecov-action","old_version":"6","new_version":"7","repository_url":"https://github.com/codecov/codecov-action"},{"name":"github/codeql-action/init","old_version":"4.35.2","new_version":"4.37.9","repository_url":"https://github.com/github/codeql-action"},{"name":"github/codeql-action/analyze","old_version":"4.35.2","new_version":"4.37.9","repository_url":"https://github.com/github/codeql-action"},{"name":"actions/github-script","old_version":"7","new_version":"9","repository_url":"https://github.com/actions/github-script"},{"name":"actions/setup-dotnet","old_version":"5.3.0","new_version":"6.0.0","repository_url":"https://github.com/actions/setup-dotnet"},{"name":"github/codeql-action/upload-sarif","old_version":"4.35.2","new_version":"4.37.9","repository_url":"https://github.com/github/codeql-action"},{"name":"actions/labeler","old_version":"6.1.0","new_version":"7.0.0","repository_url":"https://github.com/actions/labeler"},{"name":"JustinBeckwith/linkinator-action","old_version":"2.4.2","new_version":"2.4.5","repository_url":"https://github.com/justinbeckwith/linkinator-action"},{"name":"google/osv-scanner-action","old_version":"2.3.8","new_version":"2.5.1","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"release-drafter/release-drafter","old_version":"7.3.1","new_version":"7.7.0","repository_url":"https://github.com/release-drafter/release-drafter"},{"name":"actions/setup-java","old_version":"5.2.0","new_version":"6.0.0","repository_url":"https://github.com/actions/setup-java"},{"name":"actions/stale","old_version":"10","new_version":"11","repository_url":"https://github.com/actions/stale"}],"path":null,"ecosystem":"actions"},"body":"Bumps the all group with 13 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/checkout](https://github.com/actions/checkout) | `4` | `7` |\n| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `6` | `7` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.35.2` | `4.37.9` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.35.2` | `4.37.9` |\n| [actions/github-script](https://github.com/actions/github-script) | `7` | `9` |\n| [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `5.3.0` | `6.0.0` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.35.2` | `4.37.9` |\n| [actions/labeler](https://github.com/actions/labeler) | `6.1.0` | `7.0.0` |\n| [JustinBeckwith/linkinator-action](https://github.com/justinbeckwith/linkinator-action) | `2.4.2` | `2.4.5` |\n| [google/osv-scanner-action](https://github.com/google/osv-scanner-action) | `2.3.8` | `2.5.1` |\n| [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) | `7.3.1` | `7.7.0` |\n| [actions/setup-java](https://github.com/actions/setup-java) | `5.2.0` | `6.0.0` |\n| [actions/stale](https://github.com/actions/stale) | `10` | `11` |\n\n\nUpdates `actions/checkout` from 4 to 7\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/releases\"\u003eactions/checkout's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eblock checking out fork pr for pull_request_target and workflow_run by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2458\"\u003eactions/checkout#2458\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.1 to 3.4.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2460\"\u003eactions/checkout#2460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.0 to 4.2.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2461\"\u003eactions/checkout#2461\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e and \u003ccode\u003e@​actions/tool-cache\u003c/code\u003e and Remove uuid by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2459\"\u003eactions/checkout#2459\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupgrade module to esm and update dependencies by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2463\"\u003eactions/checkout#2463\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2462\"\u003eactions/checkout#2462\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003egetting ready for checkout v7 release by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2464\"\u003eactions/checkout#2464\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate error wording by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2467\"\u003eactions/checkout#2467\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6.0.3...v7.0.0\"\u003ehttps://github.com/actions/checkout/compare/v6.0.3...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003e[BREAKING]\u003c/strong\u003e backport \u003ccode\u003eallow-unsafe-pr-checkout\u003c/code\u003e to v6 by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2500\"\u003eactions/checkout#2500\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebackport fixes to releases-v6 by \u003ca href=\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2527\"\u003eactions/checkout#2527\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/\"\u003ehttps://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/\u003c/a\u003e for more details about this breaking change\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6.0.3...v6.1.0\"\u003ehttps://github.com/actions/checkout/compare/v6.0.3...v6.1.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate changelog by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2357\"\u003eactions/checkout#2357\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate changelog for v6.0.3 by \u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2446\"\u003eactions/checkout#2446\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6...v6.0.3\"\u003ehttps://github.com/actions/checkout/compare/v6...v6.0.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by \u003ca href=\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2355\"\u003eactions/checkout#2355\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6.0.1...v6.0.2\"\u003ehttps://github.com/actions/checkout/compare/v6.0.1...v6.0.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all references from v5 and v4 to v6 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2314\"\u003eactions/checkout#2314\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eClarify v6 README by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2328\"\u003eactions/checkout#2328\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1\"\u003e\u003ccode\u003e3d3c42e\u003c/code\u003e\u003c/a\u003e prep v7.0.1 release (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2531\"\u003e#2531\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07\"\u003e\u003ccode\u003e2880268\u003c/code\u003e\u003c/a\u003e escape values passed to --unset (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2530\"\u003e#2530\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1\"\u003e\u003ccode\u003e12cd223\u003c/code\u003e\u003c/a\u003e trim only ascii whitespace for branch (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2521\"\u003e#2521\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541\"\u003e\u003ccode\u003e62661c4\u003c/code\u003e\u003c/a\u003e skip running unsafe pr check if input is default (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2518\"\u003e#2518\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f\"\u003e\u003ccode\u003ee8d4307\u003c/code\u003e\u003c/a\u003e Bump the minor-actions-dependencies group with 2 updates (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2499\"\u003e#2499\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87\"\u003e\u003ccode\u003e631c942\u003c/code\u003e\u003c/a\u003e eslint 9 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2474\"\u003e#2474\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e\"\u003e\u003ccode\u003e4f1f4ae\u003c/code\u003e\u003c/a\u003e Bump actions/upload-artifact from 4 to 7 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2476\"\u003e#2476\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92\"\u003e\u003ccode\u003eba09753\u003c/code\u003e\u003c/a\u003e Bump actions/checkout from 6 to 7 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2488\"\u003e#2488\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22\"\u003e\u003ccode\u003eb9e0990\u003c/code\u003e\u003c/a\u003e Bump docker/login-action from 3.3.0 to 4.2.0 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2479\"\u003e#2479\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2\"\u003e\u003ccode\u003ee8cb398\u003c/code\u003e\u003c/a\u003e Bump docker/build-push-action from 6.5.0 to 7.2.0 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2478\"\u003e#2478\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/checkout/compare/v4...v7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `codecov/codecov-action` from 6 to 7\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/codecov/codecov-action/releases\"\u003ecodecov/codecov-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003cp\u003e⚠️ Due to migration issues with keybase, we are unable to update our keys under the \u003ccode\u003ecodecovsecurity\u003c/code\u003e account. We have deleted the account and are using \u003ccode\u003ecodecovsecops\u003c/code\u003e with the original gpg key\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eci: remove Enforce License Compliance workflow by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1950\"\u003ecodecov/codecov-action#1950\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(release): 7.0.0 by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1957\"\u003ecodecov/codecov-action#1957\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v6.0.1...v7.0.0\"\u003ehttps://github.com/codecov/codecov-action/compare/v6.0.1...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cp\u003eThis is a copy of the \u003ccode\u003ev7.0.0\u003c/code\u003e release to make updates easier\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eci: remove Enforce License Compliance workflow by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1950\"\u003ecodecov/codecov-action#1950\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(release): 7.0.0 by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1957\"\u003ecodecov/codecov-action#1957\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v6.0.1...v6.0.2\"\u003ehttps://github.com/codecov/codecov-action/compare/v6.0.1...v6.0.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: prevent template injection in run: steps (VULN-1652) by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1947\"\u003ecodecov/codecov-action#1947\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(release): 6.0.1 by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1949\"\u003ecodecov/codecov-action#1949\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1\"\u003ehttps://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md\"\u003ecodecov/codecov-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.5.2\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.1\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: overwrite pr number on fork by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1871\"\u003ecodecov/codecov-action#1871\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump actions/checkout from 4.2.2 to 5.0.0 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1868\"\u003ecodecov/codecov-action#1868\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1867\"\u003ecodecov/codecov-action#1867\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update to use local app/ dir by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1872\"\u003ecodecov/codecov-action#1872\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: fix typo in README by \u003ca href=\"https://github.com/datalater\"\u003e\u003ccode\u003e@​datalater\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1866\"\u003ecodecov/codecov-action#1866\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument a \u003ccode\u003ecodecov-cli\u003c/code\u003e version reference example by \u003ca href=\"https://github.com/webknjaz\"\u003e\u003ccode\u003e@​webknjaz\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1774\"\u003ecodecov/codecov-action#1774\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1861\"\u003ecodecov/codecov-action#1861\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1833\"\u003ecodecov/codecov-action#1833\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.0\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efeat: upgrade wrapper to 0.2.4 by \u003ca href=\"https://github.com/jviall\"\u003e\u003ccode\u003e@​jviall\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1864\"\u003ecodecov/codecov-action#1864\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin actions/github-script by Git SHA by \u003ca href=\"https://github.com/martincostello\"\u003e\u003ccode\u003e@​martincostello\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1859\"\u003ecodecov/codecov-action#1859\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: check reqs exist by \u003ca href=\"https://github.com/joseph-sentry\"\u003e\u003ccode\u003e@​joseph-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1835\"\u003ecodecov/codecov-action#1835\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: Typo in README by \u003ca href=\"https://github.com/spalmurray\"\u003e\u003ccode\u003e@​spalmurray\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1838\"\u003ecodecov/codecov-action#1838\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: Refine OIDC docs by \u003ca href=\"https://github.com/spalmurray\"\u003e\u003ccode\u003e@​spalmurray\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1837\"\u003ecodecov/codecov-action#1837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1829\"\u003ecodecov/codecov-action#1829\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.3\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1822\"\u003ecodecov/codecov-action#1822\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: OIDC on forks by \u003ca href=\"https://github.com/joseph-sentry\"\u003e\u003ccode\u003e@​joseph-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1823\"\u003ecodecov/codecov-action#1823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/codecov/codecov-action/compare/v6...v7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/init` from 4.35.2 to 4.37.9\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.37.9\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.8\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.37.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.6\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.3\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.37.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote=\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4007\"\u003e#4007\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\"\u003e2.26.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4019\"\u003e#4019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIn addition to the existing input format, the \u003ccode\u003econfig-file\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step will soon support a new \u003ccode\u003e[owner/]repo[@ref][:path]\u003c/code\u003e format. All components except the repository name are optional. If omitted, \u003ccode\u003eowner\u003c/code\u003e defaults to the same owner as the repository the analysis is running for, \u003ccode\u003eref\u003c/code\u003e to \u003ccode\u003emain\u003c/code\u003e, and \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003e.github/codeql-action.yaml\u003c/code\u003e. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3973\"\u003e#3973\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.36.3\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.36.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCache CodeQL CLI version information across Actions steps. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3943\"\u003e#3943\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3937\"\u003e#3937\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6\"\u003e2.25.6\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3948\"\u003e#3948\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.36.1\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.36.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.19.4. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.5 - 03 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.4 - 29 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.3 - 22 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.2 - 21 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote=\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4007\"\u003e#4007\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.1 - 16 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\"\u003e2.26.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4019\"\u003e#4019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.0 - 08 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/cdf488f595d80d6e07e03d4674febd5ab45fa938\"\u003e\u003ccode\u003ecdf488f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4107\"\u003e#4107\u003c/a\u003e from github/update-v4.37.9-920ba7cd1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7243f38558d187dde99730d224bb47aa26a95306\"\u003e\u003ccode\u003e7243f38\u003c/code\u003e\u003c/a\u003e Update changelog for v4.37.9\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/920ba7cd1596037e042122c00381eb16b397d68e\"\u003e\u003ccode\u003e920ba7c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4106\"\u003e#4106\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ecfa6e16817b8f490bc9a59baa391baf4fa3e3c2\"\u003e\u003ccode\u003eecfa6e1\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/adcdf4a70d247343cf9c29e0f7a6658b51c3a2b1\"\u003e\u003ccode\u003eadcdf4a\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/486fec2a3ea2626afcd8c7e9208b4f515078dd7e\"\u003e\u003ccode\u003e486fec2\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4099\"\u003e#4099\u003c/a\u003e from github/update-supported-enterprise-server-versions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/134624c67b20869c2aaa36dafa726375b78a5d76\"\u003e\u003ccode\u003e134624c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4101\"\u003e#4101\u003c/a\u003e from github/dependabot/npm_and_yarn/npm-minor-457d82...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ff43db8f982a368288f117354fb8d046e937124c\"\u003e\u003ccode\u003eff43db8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4103\"\u003e#4103\u003c/a\u003e from github/mergeback/v4.37.8-to-main-db488dde\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4605e03a74cf891614c4d76f82384a16c1c11816\"\u003e\u003ccode\u003e4605e03\u003c/code\u003e\u003c/a\u003e Rebuild\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/099c869cad6bf3b88657154d4ae47ffed27e632d\"\u003e\u003ccode\u003e099c869\u003c/code\u003e\u003c/a\u003e Update changelog and version after v4.37.8\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...cdf488f595d80d6e07e03d4674febd5ab45fa938\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.35.2 to 4.37.9\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.37.9\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.8\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.37.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.6\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.3\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.37.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote=\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4007\"\u003e#4007\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\"\u003e2.26.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4019\"\u003e#4019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIn addition to the existing input format, the \u003ccode\u003econfig-file\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step will soon support a new \u003ccode\u003e[owner/]repo[@ref][:path]\u003c/code\u003e format. All components except the repository name are optional. If omitted, \u003ccode\u003eowner\u003c/code\u003e defaults to the same owner as the repository the analysis is running for, \u003ccode\u003eref\u003c/code\u003e to \u003ccode\u003emain\u003c/code\u003e, and \u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003e.github/codeql-action.yaml\u003c/code\u003e. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3973\"\u003e#3973\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.36.3\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.36.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCache CodeQL CLI version information across Actions steps. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3943\"\u003e#3943\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3937\"\u003e#3937\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6\"\u003e2.25.6\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3948\"\u003e#3948\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.36.1\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.36.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.19.4. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.9 - 26 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.8 - 21 Aug 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.7 - 13 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.6 - 04 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.5 - 03 Aug 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.4 - 29 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egithub-codeql-tools\u003c/code\u003e \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003erepository property\u003c/a\u003e. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to \u003ccode\u003etoolcache\u003c/code\u003e to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for \u003ccode\u003etools\u003c/code\u003e in the workflow definition always takes precedence unless the value of the repository property starts with \u003ccode\u003e!\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4037\"\u003e#4037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2\"\u003e2.26.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4051\"\u003e#4051\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.3 - 22 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.2 - 21 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe new address format for the \u003ccode\u003econfig-file\u003c/code\u003e input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the \u003ccode\u003eremote=\u003c/code\u003e prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4023\"\u003e#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe CodeQL Action can now make use of \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003econfigured private registries\u003c/a\u003e in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4007\"\u003e#4007\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.1 - 16 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\"\u003e2.26.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4019\"\u003e#4019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.0 - 08 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/cdf488f595d80d6e07e03d4674febd5ab45fa938\"\u003e\u003ccode\u003ecdf488f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4107\"\u003e#4107\u003c/a\u003e from github/update-v4.37.9-920ba7cd1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7243f38558d187dde99730d224bb47aa26a95306\"\u003e\u003ccode\u003e7243f38\u003c/code\u003e\u003c/a\u003e Update changelog for v4.37.9\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/920ba7cd1596037e042122c00381eb16b397d68e\"\u003e\u003ccode\u003e920ba7c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4106\"\u003e#4106\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ecfa6e16817b8f490bc9a59baa391baf4fa3e3c2\"\u003e\u003ccode\u003eecfa6e1\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/adcdf4a70d247343cf9c29e0f7a6658b51c3a2b1\"\u003e\u003ccode\u003eadcdf4a\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.26.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/486fec2a3ea2626afcd8c7e9208b4f515078dd7e\"\u003e\u003ccode\u003e486fec2\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4099\"\u003e#4099\u003c/a\u003e from github/update-supported-enterprise-server-versions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/134624c67b20869c2aaa36dafa726375b78a5d76\"\u003e\u003ccode\u003e134624c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4101\"\u003e#4101\u003c/a\u003e from github/dependabot/npm_and_yarn/npm-minor-457d82...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ff43db8f982a368288f117354fb8d046e937124c\"\u003e\u003ccode\u003eff43db8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/4103\"\u003e#4103\u003c/a\u003e from github/mergeback/v4.37.8-to-main-db488dde\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/4605e03a74cf891614c4d76f82384a16c1c11816\"\u003e\u003ccode\u003e4605e03\u003c/code\u003e\u003c/a\u003e Rebuild\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/099c869cad6bf3b88657154d4ae47ffed27e632d\"\u003e\u003ccode\u003e099c869\u003c/code\u003e\u003c/a\u003e Update changelog and version after v4.37.8\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...cdf488f595d80d6e07e03d4674febd5ab45fa938\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/github-script` from 7 to 9\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/github-script/releases\"\u003eactions/github-script's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev9.0.0\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eNew features:\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003egetOctokit\u003c/code\u003e factory function\u003c/strong\u003e — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See \u003ca href=\"https://github.com/actions/github-script#creating-additional-clients-with-getoctokit\"\u003eCreating additional clients with \u003ccode\u003egetOctokit\u003c/code\u003e\u003c/a\u003e for details and examples.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eOrchestration ID in user-agent\u003c/strong\u003e — The \u003ccode\u003eACTIONS_ORCHESTRATION_ID\u003c/code\u003e environment variable is automatically appended to the user-agent string for request tracing.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBreaking changes:\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003erequire('@actions/github')\u003c/code\u003e no longer works in scripts.\u003c/strong\u003e The upgrade to \u003ccode\u003e@actions/github\u003c/code\u003e v9 (ESM-only) means \u003ccode\u003erequire('@actions/github')\u003c/code\u003e will fail at runtime. If you previously used patterns like \u003ccode\u003econst { getOctokit } = require('@actions/github')\u003c/code\u003e to create secondary clients, use the new injected \u003ccode\u003egetOctokit\u003c/code\u003e function instead — it's available directly in the script context with no imports needed.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003egetOctokit\u003c/code\u003e is now an injected function parameter. Scripts that declare \u003ccode\u003econst getOctokit = ...\u003c/code\u003e or \u003ccode\u003elet getOctokit = ...\u003c/code\u003e will get a \u003ccode\u003eSyntaxError\u003c/code\u003e because JavaScript does not allow \u003ccode\u003econst\u003c/code\u003e/\u003ccode\u003elet\u003c/code\u003e redeclaration of function parameters. Use the injected \u003ccode\u003egetOctokit\u003c/code\u003e directly, or use \u003ccode\u003evar getOctokit = ...\u003c/code\u003e if you need to redeclare it.\u003c/li\u003e\n\u003cli\u003eIf your script accesses other \u003ccode\u003e@actions/github\u003c/code\u003e internals beyond the standard \u003ccode\u003egithub\u003c/code\u003e/\u003ccode\u003eoctokit\u003c/code\u003e client, you may need to update those references for v9 compatibility.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd ACTIONS_ORCHESTRATION_ID to user-agent string by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/695\"\u003eactions/github-script#695\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci: use deployment: false for integration test environments by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/712\"\u003eactions/github-script#712\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat!: add getOctokit to script context, upgrade \u003ccode\u003e@​actions/github\u003c/code\u003e v9, \u003ccode\u003e@​octokit/core\u003c/code\u003e v7, and related packages by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/700\"\u003eactions/github-script#700\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/695\"\u003eactions/github-script#695\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/github-script/compare/v8.0.0...v9.0.0\"\u003ehttps://github.com/actions/github-script/compare/v8.0.0...v9.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev8.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Node.js version support to 24.x by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/637\"\u003eactions/github-script#637\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eREADME for updating actions/github-script from v7 to v8 by \u003ca href=\"https://github.com/sneha-krip\"\u003e\u003ccode\u003e@​sneha-krip\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/653\"\u003eactions/github-script#653\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e⚠️ Minimum Compatible Runner Version\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003ev2.327.1\u003c/strong\u003e\u003cbr /\u003e\n\u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003eRelease Notes\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eMake sure your runner is updated to this version or newer to use this release.\u003c/p\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/637\"\u003eactions/github-script#637\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sneha-krip\"\u003e\u003ccode\u003e@​sneha-krip\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/653\"\u003eactions/github-script#653\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/github-script/compare/v7.1.0...v8.0.0\"\u003ehttps://github.com/actions/github-script/compare/v7.1.0...v8.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev7.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade husky to v9 by \u003ca href=\"https://github.com/benelan\"\u003e\u003ccode\u003e@​benelan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/482\"\u003eactions/github-script#482\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd workflow file for publishing releases to immutable action package by \u003ca href=\"https://github.com/Jcambass\"\u003e\u003ccode\u003e@​Jcambass\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/485\"\u003eactions/github-script#485\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade IA Publish by \u003ca href=\"https://github.com/Jcambass\"\u003e\u003ccode\u003e@​Jcambass\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/486\"\u003eactions/github-script#486\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix workflow status badges by \u003ca href=\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/497\"\u003eactions/github-script#497\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate usage of \u003ccode\u003eactions/upload-artifact\u003c/code\u003e by \u003ca href=\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/512\"\u003eactions/github-script#512\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eClear up package name confusion by \u003ca href=\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/514\"\u003eactions/github-script#514\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependencies with \u003ccode\u003enpm audit fix\u003c/code\u003e by \u003ca href=\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/515\"\u003eactions/github-script#515\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSpecify that the used script is JavaScript by \u003ca href=\"https://github.com/timotk\"\u003e\u003ccode\u003e@​timotk\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/478\"\u003eactions/github-script#478\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: Add Dependabot for NPM and Actions by \u003ca href=\"https://github.com/nschonni\"\u003e\u003ccode\u003e@​nschonni\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/github-script/pull/472\"\u003eactions/github-script#472\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/github-script/commit/3a2844b7e9c422d3c10d287c895573f7108da1b3\"\u003e\u003ccode\u003e3a2844b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/github-script/issues/700\"\u003e#700\u003c/a\u003e from actions/salmanmkc/expose-getoctokit + prepare re...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/github-script/commit/ca10bbdd1a7739de09e99a200c7a59f5d73a4079\"\u003e\u003ccode\u003eca10bbd\u003c/code\u003e\u003c/a\u003e fix: use \u003ccode\u003e@​octokit/core/\u003c/code\u003etypes import for v7 compatibility\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/github-script/commit/86e48e20ac85c970ed1f96e718fd068173948b7b\"\u003e\u003ccode\u003e86e48e2\u003c/code\u003e\u003c/a\u003e merge: incorporate main branch changes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/github-script/commit/c1084728b5b935ec4ddc1e4cee877b01797b3ff9\"\u003e\u003ccode\u003ec108472\u003c/code\u003e\u003c/a\u003e chore: rebuild dist for v9 upgrade and getOctokit factory\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/github-script/commit/afff112e4f8b57c718168af75b89ce00bc8d091d\"\u003e\u003ccode\u003eafff112\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/github-script/issues/712\"\u003e#712\u003c/a\u003e from actions/salmanmkc/deployment-false + fix user-ag...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/github-script/commit/ff8117e5b78c415f814f39ad6998f424fee7b817\"\u003e\u003ccode\u003eff8117e\u003c/code\u003e\u003c/a\u003e ci: fix user-agent test to handle orchestration ID\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/github-script/commit/81c6b7876079abe10ff715951c9fc7b3e1ab389d\"\u003e\u003ccode\u003e81c6b78\u003c/code\u003e\u003c/a\u003e ci: use deployment: false to suppress deployment noise from integration tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/github-script/commit/3953caf8858d318f37b6cc53a9f5708859b5a7b7\"\u003e\u003ccode\u003e3953caf\u003c/code\u003e\u003c/a\u003e docs: update README examples from \u003ca href=\"https://github.com/v8\"\u003e\u003ccode\u003e@​v8\u003c/code\u003e\u003c/a\u003e to \u003ca href=\"https://github.com/v9\"\u003e\u003ccode\u003e@​v9\u003c/code\u003e\u003c/a\u003e, add getOctokit docs and v9 brea...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/github-script/commit/c17d55b90dcdb3d554d0027a6c180a7adc2daf78\"\u003e\u003ccode\u003ec17d55b\u003c/code\u003e\u003c/a\u003e ci: add getOctokit integration test job\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/github-script/commit/a047196d9a02fe92098771cafbb98c2f1814e408\"\u003e\u003ccode\u003ea047196\u003c/code\u003e\u003c/a\u003e test: add getOctokit integration tests via callAsyncFunction\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/github-script/compare/v7...v9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/setup-dotnet` from 5.3.0 to 6.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/setup-dotnet/releases\"\u003eactions/setup-dotnet's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate to ESM and upgrade dependencies by \u003ca href=\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/752\"\u003eactions/setup-dotnet#752\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 6.0.3 to 7.0.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/751\"\u003eactions/setup-dotnet#751\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 by \u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/756\"\u003eactions/setup-dotnet#756\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/756\"\u003eactions/setup-dotnet#756\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/setup-dotnet/compare/v5...v6.0.0\"\u003ehttps://github.com/actions/setup-dotnet/compare/v5...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePin actions to commit SHAs in workflows by \u003ca href=\"https://github.com/priya-kinthali\"\u003e\u003ccode\u003e@​priya-kinthali\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/744\"\u003eactions/setup-dotnet#744\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpand the CSC problem matcher to light up more errors on GitHub. by \u003ca href=\"https://github.com/StephenCleary\"\u003e\u003ccode\u003e@​StephenCleary\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/717\"\u003eactions/setup-dotnet#717\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImprove global.json SDK version validation for rollForward by \u003ca href=\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/742\"\u003eactions/setup-dotnet#742\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cblockquote\u003e\n\u003cp\u003eThe action now validates the \u003ccode\u003esdk.version\u003c/code\u003e field in \u003ccode\u003eglobal.json\u003c/code\u003e when \u003ccode\u003erollForward\u003c/code\u003e is specified. The version must be a fully-qualified SDK version (e.g., \u003ccode\u003e8.0.100\u003c/code\u003e, \u003ccode\u003e10.0.100\u003c/code\u003e). Wildcard versions (e.g., \u003ccode\u003e10.0.*\u003c/code\u003e) and runtime-style versions (e.g., \u003ccode\u003e8.0.0\u003c/code\u003e) will now fail. See the \u003ca href=\"https://learn.microsoft.com/en-us/dotnet/core/tools/global-json#version\"\u003e.NET SDK version specification\u003c/a\u003e for details.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch3\u003eDocumentation\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDocs(action): Explicitly mark all optional inputs with required: false by \u003ca href=\"https://github.com/kranthipoturaju\"\u003e\u003ccode\u003e@​kranthipoturaju\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/737\"\u003eactions/setup-dotnet#737\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix global.json creation command by \u003ca href=\"https://github.com/michal2612\"\u003e\u003ccode\u003e@​michal2612\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/694\"\u003eactions/setup-dotnet#694\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency Updates\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​actions/cache\u003c/code\u003e to 5.1.0, log cache write denied by \u003ca href=\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/746\"\u003eactions/setup-dotnet#746\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/746\"\u003eactions/setup-dotnet#746\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/michal2612\"\u003e\u003ccode\u003e@​michal2612\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/694\"\u003eactions/setup-dotnet#694\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kranthipoturaju\"\u003e\u003ccode\u003e@​kranthipoturaju\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/737\"\u003eactions/setup-dotnet#737\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/StephenCleary\"\u003e\u003ccode\u003e@​StephenCleary\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/setup-dotnet/pull/717\"\u003eactions/setup-dotnet#717\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/setup-dotnet/compare/v5.3.0...v5.4.0\"\u003ehttps://github.com/actions/setup-dotnet/compare/v5.3.0...v5.4.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-dotnet/commit/a98b56852c35b8e3190ac28c8c2271da59106c68\"\u003e\u003ccode\u003ea98b568\u003c/code\u003e\u003c/a\u003e chore(deps): bump \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 (\u003ca href=\"https://redirect.github.com/actions/setup-dotnet/issues/756\"\u003e#756\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-dotnet/commit/afb2931642fd907238eb71bce2da0dcc910b3553\"\u003e\u003ccode\u003eafb2931\u003c/code\u003e\u003c/a\u003e Bump actions/checkout from 6.0.3 to 7.0.0 (\u003ca href=\"https://redirect.github.com/actions/setup-dotnet/issues/751\"\u003e#751\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-dotnet/commit/6df8cefd1440cf9313e76b8fdb8aaf90cfa745a3\"\u003e\u003ccode\u003e6df8cef\u003c/code\u003e\u003c/a\u003e Migrate to ESM and upgrade dependencies (\u003ca href=\"https://redirect.github.com/actions/setup-dotnet/issues/752\"\u003e#752\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-dotnet/commit/26b0ec14cb23fa6904739307f278c14f94c95bf1\"\u003e\u003ccode\u003e26b0ec1\u003c/code\u003e\u003c/a\u003e Expand the CSC problem matcher to light up more errors on GitHub. (\u003ca href=\"https://redirect.github.com/actions/setup-dotnet/issues/717\"\u003e#717\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-dotnet/commit/da5e5482f2d0700168cff080da45b50da8b60f0e\"\u003e\u003ccode\u003eda5e548\u003c/code\u003e\u003c/a\u003e docs(action): explicitly mark all optional inputs with required: false (\u003ca href=\"https://redirect.github.com/actions/setup-dotnet/issues/737\"\u003e#737\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-dotnet/commit/9bd3b44355ba7c500f3d2e029636c6d29ac5caab\"\u003e\u003ccode\u003e9bd3b44\u003c/code\u003e\u003c/a\u003e Improve readability of global.json creation command (\u003ca href=\"https://redirect.github.com/actions/setup-dotnet/issues/694\"\u003e#694\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-dotnet/commit/4406a635cd2be9c92689ea22b2f74ea57297088c\"\u003e\u003ccode\u003e4406a63\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/cache\u003c/code\u003e to 5.1.0, log cache write denied (\u003ca href=\"https://redirect.github.com/actions/setup-dotnet/issues/746\"\u003e#746\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-dotnet/commit/dc3262dda80e97f1c7865b3b122e99240e30b738\"\u003e\u003ccode\u003edc3262d\u003c/code\u003e\u003c/a\u003e pin actions to commit SHAs in workflows (\u003ca href=\"https://redirect.github.com/actions/setup-dotnet/issues/744\"\u003e#744\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/setup-dotnet/commit/95a3f8b067437dc9b2027a437f5dc3b4569ddd49\"\u003e\u003ccode\u003e95a3f8b\u003c/code\u003e\u003c/a\u003e Validate global.json SDK version before rollForward optimization (\u003ca href=\"https://redirect.github.com/actions/setup-dotnet/issues/742\"\u003e#742\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/setup-dotnet/compare/9a946fdbd5fb07b82b2f5a4466058b876ab72bb2...a98b56852c35b8e3190ac28c8c2271da59106c68\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/upload-sarif` from 4.35.2 to 4.37.9\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/upload-sarif's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.37.9\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4\"\u003e2.26.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4106\"\u003e#4106\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.8\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003ev4.37.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3\"\u003e2.26.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4085\"\u003e#4085\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.6\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChanged the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to \u003ccode\u003e.github/codeql-config.yml\u003c/code\u003e to align it with the suggested path that is used elsewhere. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4070\"\u003e#4070\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the \u003ccode\u003einit\u003c/code\u003e Action instead of falling back to downloading the bundle before extracting it. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/4061\"\u003e#4061\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.37.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThis version of the CodeQL Action adds support for the \u003ccode\u003etools\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e step to be specified using a \u003ccode\u003egith...\n\n_Description has been truncated_\n\n\u003c!-- This is an auto-generated description by cubic. --\u003e\n---\n## Summary by cubic\nUpdates 13 GitHub Actions across 21 workflow files to their latest versions, keeping CI tooling current.\n\n**Breaking changes**\n- `actions/checkout` v7 blocks checkout of fork PRs for `pull_request_target` and `workflow_run` triggers unless `allow-unsafe-pr-checkout` is set.\n- `actions/github-script` v9 is ESM-only and no longer supports `require('@actions/github')`; scripts using it must switch to the injected `getOctokit` function.\n- `actions/setup-dotnet` v5.4+ now rejects wildcard or runtime-style versions in `global.json` when `rollForward` is set; v6 adds ESM migration and runner requirement v2.327.1+.\n- `actions/setup-java` v6 and `actions/labeler` v7 require runner v2.327.1+ and may change label matching behavior.\n\n\u003csup\u003eWritten for commit ac7b8dbbcd487c234c3374d7b3e7d41ba6abe734. Summary will update on new commits.\u003c/sup\u003e\n\n\u003ca href=\"https://cubic.dev/pr/antigravityos187-sketch/universal-or-strategy/pull/33?utm_source=github\" target=\"_blank\" rel=\"noopener noreferrer\" data-no-image-dialog=\"true\"\u003e\u003cpicture\u003e\u003csource media=\"(prefers-color-scheme: dark)\" srcset=\"https://www.cubic.dev/buttons/review-in-cubic-dark.svg\"\u003e\u003csource media=\"(prefers-color-scheme: light)\" srcset=\"https://www.cubic.dev/buttons/review-in-cubic-light.svg\"\u003e\u003cimg alt=\"Review in cubic\" src=\"https://www.cubic.dev/buttons/review-in-cubic-dark.svg\"\u003e\u003c/picture\u003e\u003c/a\u003e\n\n\u003c!-- End of auto-generated description by cubic. --\u003e","html_url":"https://github.com/antigravityos187-sketch/universal-or-strategy/pull/33","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/antigravityos187-sketch%2Funiversal-or-strategy/issues/33","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/33/packages"}},{"old_version":"2.3.8","new_version":"2.5.1","update_type":"minor","path":null,"pr_created_at":"2026-08-25T13:33:36.000Z","version_change":"2.3.8 → 2.5.1","issue":{"uuid":"5246469642","node_id":"PR_kwDOQCFGY88AAAABA8Ux6A","number":81,"state":"closed","title":"Bump google/osv-scanner-action from 2.3.8 to 2.5.1","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-09-04T08:45:02.000Z","author_association":null,"state_reason":null,"created_at":"2026-08-25T13:33:36.000Z","updated_at":"2026-09-04T08:45:10.000Z","time_to_close":846686,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"google/osv-scanner-action","old_version":"2.3.8","new_version":"2.5.1","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [google/osv-scanner-action](https://github.com/google/osv-scanner-action) from 2.3.8 to 2.5.1.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.1\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions/checkout action to v7 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/133\"\u003egoogle/osv-scanner-action#133\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve package namespaces when querying osv.dev API (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2978\"\u003e#2978\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eRe-add support for the \u003ccode\u003eOSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY\u003c/code\u003e environment variable (fixes \u003ca href=\"https://redirect.github.com/google/osv-scanner/issues/2983\"\u003e#2983\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eFix local vulnerability matching (\u003ccode\u003e--offline-vulnerabilities\u003c/code\u003e) not working when network capability is \u003ccode\u003eNetworkOnline\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.5.0...v2.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.5.0 as well as:\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: gate reusable workflow outputs with a flag by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/130\"\u003egoogle/osv-scanner-action#130\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin download-artifact action to SHA by \u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add runs-on input to reusable workflows by \u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: address zizmor warnings by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/135\"\u003egoogle/osv-scanner-action#135\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: add GOTOOLCHAIN=auto env to osv-scanner calls by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/138\"\u003egoogle/osv-scanner-action#138\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/6e4298ebc4db23e847df9b2e2de2939d6f066c67\"\u003e\u003ccode\u003e6e4298e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/141\"\u003e#141\u003c/a\u003e from google/update-to-v2.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/5957b4e7a8725730a37d973099c16b9fe44cfc5f\"\u003e\u003ccode\u003e5957b4e\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.1 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/880d9b542cc66d36d91d51b3fbcc038f5f28cfc5\"\u003e\u003ccode\u003e880d9b5\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.1 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/baa4139e56d6312335d899e6ba045fa16d1d3d0b\"\u003e\u003ccode\u003ebaa4139\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.5.1 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f4cfcc01edc9c8b756a9b873b7a623ca674da51e\"\u003e\u003ccode\u003ef4cfcc0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/117\"\u003e#117\u003c/a\u003e from renovate-bot/renovate/workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dfd4cd1d0114e5fc71a6862faf1114ed69d9dca7\"\u003e\u003ccode\u003edfd4cd1\u003c/code\u003e\u003c/a\u003e Update workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/e13f842f8f0b5845b610f16e8a2eb7f22a7f8677\"\u003e\u003ccode\u003ee13f842\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/133\"\u003e#133\u003c/a\u003e from renovate-bot/renovate/major-workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8deb546fdb875b9996d27d4950be7312dac076a1\"\u003e\u003ccode\u003e8deb546\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/140\"\u003e#140\u003c/a\u003e from google/update-to-v2.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8fb3f8c89519ea2c868d3277441ee7fd3c7f15af\"\u003e\u003ccode\u003e8fb3f8c\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.0 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/0c58c542420dfd23fcac08dd9c8ca3cca9c36f1a\"\u003e\u003ccode\u003e0c58c54\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.0 actions\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google/osv-scanner-action\u0026package-manager=github_actions\u0026previous-version=2.3.8\u0026new-version=2.5.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/andreibesleaga/camara-emergency-demo/pull/81","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/andreibesleaga%2Fcamara-emergency-demo/issues/81","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/81/packages"}},{"old_version":"2.3.8","new_version":"2.5.0","update_type":"minor","path":null,"pr_created_at":"2026-08-11T06:08:44.000Z","version_change":"2.3.8 → 2.5.0","issue":{"uuid":"5117211691","node_id":"PR_kwDOPJG7H879W8OL","number":47,"state":"closed","title":"chore(deps): bump the actions group with 2 updates","user":"dependabot[bot]","labels":["dependencies"],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":"2026-08-13T14:07:06.000Z","author_association":null,"state_reason":null,"created_at":"2026-08-11T06:08:44.000Z","updated_at":"2026-08-13T14:07:08.000Z","time_to_close":201502,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"actions","update_count":2,"packages":[{"name":"pnpm/action-setup","old_version":"6.0.9","new_version":"6.0.10","repository_url":"https://github.com/pnpm/action-setup"},{"name":"google/osv-scanner-action","old_version":"2.3.8","new_version":"2.5.0","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"[//]: # (dependabot-start)\n⚠️  **Dependabot is rebasing this PR** ⚠️ \n\nRebasing might not happen immediately, so don't worry if this takes some time.\n\nNote: if you make any changes to this PR yourself, they will take precedence over the rebase.\n\n---\n\n[//]: # (dependabot-end)\n\nBumps the actions group with 2 updates: [pnpm/action-setup](https://github.com/pnpm/action-setup) and [google/osv-scanner-action](https://github.com/google/osv-scanner-action).\n\nUpdates `pnpm/action-setup` from 6.0.9 to 6.0.10\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pnpm/action-setup/releases\"\u003epnpm/action-setup's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.10\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs(README): point users to the successor pnpm/setup action by \u003ca href=\"https://github.com/BlackHole1\"\u003e\u003ccode\u003e@​BlackHole1\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pnpm/action-setup/pull/282\"\u003epnpm/action-setup#282\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erefactor: introduce restore keys for cache by \u003ca href=\"https://github.com/SukkaW\"\u003e\u003ccode\u003e@​SukkaW\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pnpm/action-setup/pull/280\"\u003epnpm/action-setup#280\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci: use pnpm 11 for \u003ccode\u003epr-check\u003c/code\u003e by \u003ca href=\"https://github.com/jamietanna\"\u003e\u003ccode\u003e@​jamietanna\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pnpm/action-setup/pull/284\"\u003epnpm/action-setup#284\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update pnpm to v11.19.0 by \u003ca href=\"https://github.com/jamietanna\"\u003e\u003ccode\u003e@​jamietanna\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pnpm/action-setup/pull/283\"\u003epnpm/action-setup#283\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: update README to include devEngines.packageManager by \u003ca href=\"https://github.com/nemchik\"\u003e\u003ccode\u003e@​nemchik\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pnpm/action-setup/pull/273\"\u003epnpm/action-setup#273\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jamietanna\"\u003e\u003ccode\u003e@​jamietanna\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/pnpm/action-setup/pull/284\"\u003epnpm/action-setup#284\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nemchik\"\u003e\u003ccode\u003e@​nemchik\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/pnpm/action-setup/pull/273\"\u003epnpm/action-setup#273\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/pnpm/action-setup/compare/v6...v6.0.10\"\u003ehttps://github.com/pnpm/action-setup/compare/v6...v6.0.10\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pnpm/action-setup/commit/0977fd99725f1db4007ccb2928dbb4e90d06cc86\"\u003e\u003ccode\u003e0977fd9\u003c/code\u003e\u003c/a\u003e docs: Update README to include devEngines.packageManager (\u003ca href=\"https://redirect.github.com/pnpm/action-setup/issues/273\"\u003e#273\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pnpm/action-setup/commit/48261aca053e825d84804e8ce05524d558249ac9\"\u003e\u003ccode\u003e48261ac\u003c/code\u003e\u003c/a\u003e fix: update pnpm to v11.19.0 (\u003ca href=\"https://redirect.github.com/pnpm/action-setup/issues/283\"\u003e#283\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pnpm/action-setup/commit/75677f717d48404e86ae8ee4891543f40de175aa\"\u003e\u003ccode\u003e75677f7\u003c/code\u003e\u003c/a\u003e ci: use pnpm 11 for \u003ccode\u003epr-check\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/pnpm/action-setup/issues/284\"\u003e#284\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pnpm/action-setup/commit/769ae71fb33e6e448a5dc92ad5da997c268eecec\"\u003e\u003ccode\u003e769ae71\u003c/code\u003e\u003c/a\u003e refactor: introduce restore keys for cache (\u003ca href=\"https://redirect.github.com/pnpm/action-setup/issues/280\"\u003e#280\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pnpm/action-setup/commit/6fed91f804570c1144bfe1911c348642cb986bd4\"\u003e\u003ccode\u003e6fed91f\u003c/code\u003e\u003c/a\u003e docs(README): point users to the successor pnpm/setup action (\u003ca href=\"https://redirect.github.com/pnpm/action-setup/issues/282\"\u003e#282\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/pnpm/action-setup/compare/v6.0.9...v6.0.10\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action` from 2.3.8 to 2.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.0\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.5.0 as well as:\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: gate reusable workflow outputs with a flag by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/130\"\u003egoogle/osv-scanner-action#130\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin download-artifact action to SHA by \u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add runs-on input to reusable workflows by \u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: address zizmor warnings by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/135\"\u003egoogle/osv-scanner-action#135\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: add GOTOOLCHAIN=auto env to osv-scanner calls by \u003ca href=\"https://github.com/another-rex\"\u003e\u003ccode\u003e@​another-rex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/138\"\u003egoogle/osv-scanner-action#138\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/SVilgelm\"\u003e\u003ccode\u003e@​SVilgelm\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/127\"\u003egoogle/osv-scanner-action#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/BeyondEvil\"\u003e\u003ccode\u003e@​BeyondEvil\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/131\"\u003egoogle/osv-scanner-action#131\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8deb546fdb875b9996d27d4950be7312dac076a1\"\u003e\u003ccode\u003e8deb546\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/140\"\u003e#140\u003c/a\u003e from google/update-to-v2.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8fb3f8c89519ea2c868d3277441ee7fd3c7f15af\"\u003e\u003ccode\u003e8fb3f8c\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.5.0 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/0c58c542420dfd23fcac08dd9c8ca3cca9c36f1a\"\u003e\u003ccode\u003e0c58c54\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.5.0 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/06b2ab4348248b456ee06c9e953637f55e03504f\"\u003e\u003ccode\u003e06b2ab4\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.5.0 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9fd1bcce27f67e3bd819a0a7620e332803dc43bc\"\u003e\u003ccode\u003e9fd1bcc\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/138\"\u003e#138\u003c/a\u003e from google/fix/gotoolchain-auto\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/01a87d56220b68b35ceebc4a7a3f3de666173da6\"\u003e\u003ccode\u003e01a87d5\u003c/code\u003e\u003c/a\u003e fix: add GOTOOLCHAIN=auto env to osv-scanner calls\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/a82132c0bd6c7261ffcb78e754c46c70ab57ad9a\"\u003e\u003ccode\u003ea82132c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/135\"\u003e#135\u003c/a\u003e from google/fix-zizmor-excessive-permissions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/272ff57b30ae5bef2488ba122ab6852c0d735a2d\"\u003e\u003ccode\u003e272ff57\u003c/code\u003e\u003c/a\u003e fix: address zizmor template injection warnings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/10621fba4fb802e4fbe82d664deb6d5c44d233d5\"\u003e\u003ccode\u003e10621fb\u003c/code\u003e\u003c/a\u003e refactor: move permissions to job level to satisfy zizmor\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fa4ff678dd5d0a4fa3d628e57af8162873e93cd6\"\u003e\u003ccode\u003efa4ff67\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/131\"\u003e#131\u003c/a\u003e from BeyondEvil/feat/add-runs-on-input\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/NaturalDevCR/atemporal/pull/47","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/NaturalDevCR%2Fatemporal/issues/47","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/47/packages"}},{"old_version":"2.2.3","new_version":"2.3.8","update_type":"minor","path":null,"pr_created_at":"2026-06-02T05:31:52.000Z","version_change":"2.2.3 → 2.3.8","issue":{"uuid":"4568724114","node_id":"PR_kwDOPvOdvs7hpgTe","number":288,"state":"open","title":"ci: bump the github-actions group with 2 updates","user":"dependabot[bot]","labels":["dependencies"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-02T05:31:52.000Z","updated_at":"2026-06-02T05:31:53.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci: bump","group_name":"github-actions","update_count":2,"packages":[{"name":"google/osv-scanner-action","old_version":"2.2.3","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"gitleaks/gitleaks-action","old_version":"2","new_version":"3","repository_url":"https://github.com/gitleaks/gitleaks-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions group with 2 updates: [google/osv-scanner-action](https://github.com/google/osv-scanner-action) and [gitleaks/gitleaks-action](https://github.com/gitleaks/gitleaks-action).\n\nUpdates `google/osv-scanner-action` from 2.2.3 to 2.3.8\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.5\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.5.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to v2.3.5 by \u003ca href=\"https://github.com/tobyhawker\"\u003e\u003ccode\u003e@​tobyhawker\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/124\"\u003egoogle/osv-scanner-action#124\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tobyhawker\"\u003e\u003ccode\u003e@​tobyhawker\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/124\"\u003egoogle/osv-scanner-action#124\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.3...v2.3.5\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.3...v2.3.5\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.3\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.3.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): update github/codeql-action action to v4.31.10 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/115\"\u003egoogle/osv-scanner-action#115\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate to v2.3.3 by \u003ca href=\"https://github.com/Ly-Joey\"\u003e\u003ccode\u003e@​Ly-Joey\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/118\"\u003egoogle/osv-scanner-action#118\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Ly-Joey\"\u003e\u003ccode\u003e@​Ly-Joey\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/118\"\u003egoogle/osv-scanner-action#118\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.2...v2.3.3\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.2...v2.3.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.2\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.2\u003c/p\u003e\n\u003cp\u003eThis release includes performance improvements for local scanning, reducing memory usage and avoiding unnecessary advisory loading. It also fixes issues with MCP's get_vulnerability_details tool, git queries in \u003ccode\u003eosv-scanner.json\u003c/code\u003e, and ignore entry tracking, along with documentation updates.\u003c/p\u003e\n\u003ch3\u003eFixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2415\"\u003e#2415\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2415\"\u003egoogle/osv-scanner#2415\u003c/a\u003e) Add more PURL-to-ecosystem mappings\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2422\"\u003e#2422\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2422\"\u003egoogle/osv-scanner#2422\u003c/a\u003e) MCP error for get_vulnerability_id because type definition is incorrect.\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2460\"\u003e#2460\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2460\"\u003egoogle/osv-scanner#2460\u003c/a\u003e) Enable osv-scanner.json git queries\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2456\"\u003e#2456\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2456\"\u003egoogle/osv-scanner#2456\u003c/a\u003e) Properly track if an ignore entry has been used\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2450\"\u003e#2450\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2450\"\u003egoogle/osv-scanner#2450\u003c/a\u003e) \u003cstrong\u003ePerformance:\u003c/strong\u003e Avoid loading the entire advisory unless it will actually be used\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2445\"\u003e#2445\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2445\"\u003egoogle/osv-scanner#2445\u003c/a\u003e) \u003cstrong\u003ePerformance:\u003c/strong\u003e Don't read the entire zip into memory\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2433\"\u003e#2433\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2433\"\u003egoogle/osv-scanner#2433\u003c/a\u003e) Allow specifying user agent in v2 osvscanner package\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMisc:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e[Misc \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2453\"\u003e#2453\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2453\"\u003egoogle/osv-scanner#2453\u003c/a\u003e) Switch from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3\u003c/li\u003e\n\u003cli\u003e[Misc \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2447\"\u003e#2447\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2447\"\u003egoogle/osv-scanner#2447\u003c/a\u003e) Include \u003ccode\u003ebun.lock\u003c/code\u003e as a supported lockfile\u003c/li\u003e\n\u003cli\u003e[Misc \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2444\"\u003e#2444\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2444\"\u003egoogle/osv-scanner#2444\u003c/a\u003e) Document GoVersionOverride in configuration.md\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9517144e5504957104c831530fe605bfdc71f353\"\u003e\u003ccode\u003e9517144\u003c/code\u003e\u003c/a\u003e feat: output results in reusable workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f17cd09224d6ef8be953fb49371e6bffb2dbf44a\"\u003e\u003ccode\u003ef17cd09\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into main\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.2.3...v2.3.8\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `gitleaks/gitleaks-action` from 2 to 3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/gitleaks/gitleaks-action/releases\"\u003egitleaks/gitleaks-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's changed\u003c/h2\u003e\n\u003cp\u003egitleaks-action v3 migrates the runtime from Node 20 to Node 24. \u003cstrong\u003eNo changes to inputs, outputs, or behavior.\u003c/strong\u003e Update your workflow from \u003ccode\u003egitleaks/gitleaks-action@v2\u003c/code\u003e to \u003ccode\u003egitleaks/gitleaks-action@v3\u003c/code\u003e.\u003c/p\u003e\n\u003ch3\u003eMigration\u003c/h3\u003e\n\u003cpre lang=\"yaml\"\u003e\u003ccode\u003e# Before\n- uses: gitleaks/gitleaks-action@v2\n\u003ch1\u003eAfter\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003euses: gitleaks/gitleaks-action@v3\u003cbr /\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eWhy\u003c/h3\u003e\n\u003cp\u003eGitHub is deprecating the Node 20 runtime for Actions:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eJune 2, 2026:\u003c/strong\u003e GitHub flips the runner default to Node 24. Workflows using \u003ccode\u003egitleaks-action@v2\u003c/code\u003e (Node 20) will still run, but only if \u003ccode\u003eACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true\u003c/code\u003e is set as an environment variable.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eSeptember 16, 2026:\u003c/strong\u003e Node 20 is removed from GitHub-hosted runners entirely. \u003ccode\u003egitleaks-action@v2\u003c/code\u003e stops working regardless of any opt-out flag.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eaction.yml\u003c/code\u003e: runtime \u003ccode\u003enode20\u003c/code\u003e → \u003ccode\u003enode24\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e@actions/core\u003c/code\u003e: 1.10.0 → 1.11.1\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003edist/\u003c/code\u003e rebuilt\u003c/li\u003e\n\u003cli\u003eExample workflows updated to \u003ccode\u003eactions/checkout@v6\u003c/code\u003e and \u003ccode\u003egitleaks-action@v3\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eREADME updated with v3 migration guide\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eSelf-hosted runners\u003c/h3\u003e\n\u003cp\u003eIf you use self-hosted runners, ensure your runner version is \u003ccode\u003e\u0026gt;= v2.327.1\u003c/code\u003e (required for Node 24 support).\u003c/p\u003e\n\u003ch2\u003ev2.3.9\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebump cache by \u003ca href=\"https://github.com/zricethezav\"\u003e\u003ccode\u003e@​zricethezav\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitleaks/gitleaks-action/pull/181\"\u003egitleaks/gitleaks-action#181\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/gitleaks/gitleaks-action/compare/v2.3.8...v2.3.9\"\u003ehttps://github.com/gitleaks/gitleaks-action/compare/v2.3.8...v2.3.9\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd environment variable to override gitleaks baseRef by \u003ca href=\"https://github.com/paulschuberth\"\u003e\u003ccode\u003e@​paulschuberth\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitleaks/gitleaks-action/pull/113\"\u003egitleaks/gitleaks-action#113\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebump default gitleaks version, update license filename, fix vulns by \u003ca href=\"https://github.com/zricethezav\"\u003e\u003ccode\u003e@​zricethezav\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitleaks/gitleaks-action/pull/178\"\u003egitleaks/gitleaks-action#178\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/paulschuberth\"\u003e\u003ccode\u003e@​paulschuberth\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/gitleaks/gitleaks-action/pull/113\"\u003egitleaks/gitleaks-action#113\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/gitleaks/gitleaks-action/compare/v2.3.7...v2.3.8\"\u003ehttps://github.com/gitleaks/gitleaks-action/compare/v2.3.7...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitleaks/gitleaks-action/commit/e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e\"\u003e\u003ccode\u003ee0c47f4\u003c/code\u003e\u003c/a\u003e chore: migrate to Node 24 runtime (v3)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitleaks/gitleaks-action/commit/bf2dc8e55639c1e091e9b45970152e4313705814\"\u003e\u003ccode\u003ebf2dc8e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/gitleaks/gitleaks-action/issues/191\"\u003e#191\u003c/a\u003e from Olexandr88/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitleaks/gitleaks-action/commit/b71323b056f4cc8c7f4cc7decfcc26b5e80b8e15\"\u003e\u003ccode\u003eb71323b\u003c/code\u003e\u003c/a\u003e Update README.md\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitleaks/gitleaks-action/commit/9c66aa96d2700e2b6aa0f9f7021ae6e5cc7a4375\"\u003e\u003ccode\u003e9c66aa9\u003c/code\u003e\u003c/a\u003e Update README.md\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitleaks/gitleaks-action/commit/186c3fea8923e06a92dc3806067ad6afaf53e754\"\u003e\u003ccode\u003e186c3fe\u003c/code\u003e\u003c/a\u003e Create FUNDING.yml\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/gitleaks/gitleaks-action/compare/v2...v3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/po4yka/ratatoskr/pull/288","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/po4yka%2Fratatoskr/issues/288","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/288/packages"}},{"old_version":"2.3.5","new_version":"2.3.8","update_type":"patch","path":null,"pr_created_at":"2026-06-01T02:43:31.000Z","version_change":"2.3.5 → 2.3.8","issue":{"uuid":"4559938710","node_id":"PR_kwDOQTCNSM7hM2rS","number":65,"state":"open","title":"ci: bump google/osv-scanner-action from 2.3.5 to 2.3.8","user":"dependabot[bot]","labels":["dependencies"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-01T02:43:31.000Z","updated_at":"2026-06-01T02:44:28.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci","packages":[{"name":"google/osv-scanner-action","old_version":"2.3.5","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [google/osv-scanner-action](https://github.com/google/osv-scanner-action) from 2.3.5 to 2.3.8.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9517144e5504957104c831530fe605bfdc71f353\"\u003e\u003ccode\u003e9517144\u003c/code\u003e\u003c/a\u003e feat: output results in reusable workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f17cd09224d6ef8be953fb49371e6bffb2dbf44a\"\u003e\u003ccode\u003ef17cd09\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into main\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google/osv-scanner-action\u0026package-manager=github_actions\u0026previous-version=2.3.5\u0026new-version=2.3.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/antonio59/ProtectMyMobile/pull/65","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/antonio59%2FProtectMyMobile/issues/65","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/65/packages"}},{"old_version":"2.2.4","new_version":"2.3.8","update_type":"minor","path":null,"pr_created_at":"2026-05-30T19:29:21.000Z","version_change":"2.2.4 → 2.3.8","issue":{"uuid":"4555447739","node_id":"PR_kwDOSsdUbs7g_cEb","number":4,"state":"closed","title":"ci: bump the actions group across 1 directory with 9 updates","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":5,"pull_request":true,"closed_at":"2026-05-31T01:16:58.000Z","author_association":null,"state_reason":null,"created_at":"2026-05-30T19:29:21.000Z","updated_at":"2026-05-31T01:17:07.000Z","time_to_close":20857,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"ci: bump","group_name":"actions","update_count":9,"packages":[{"name":"actions/checkout","old_version":"4","new_version":"6","repository_url":"https://github.com/actions/checkout"},{"name":"jdx/mise-action","old_version":"2","new_version":"4","repository_url":"https://github.com/jdx/mise-action"},{"name":"actions/upload-artifact","old_version":"4","new_version":"7","repository_url":"https://github.com/actions/upload-artifact"},{"name":"DavidAnson/markdownlint-cli2-action","old_version":"17","new_version":"23","repository_url":"https://github.com/davidanson/markdownlint-cli2-action"},{"name":"docker/setup-buildx-action","old_version":"3","new_version":"4","repository_url":"https://github.com/docker/setup-buildx-action"},{"name":"docker/bake-action","old_version":"6","new_version":"7","repository_url":"https://github.com/docker/bake-action"},{"name":"google/osv-scanner-action","old_version":"2.2.4","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"github/codeql-action","old_version":"3","new_version":"4","repository_url":"https://github.com/github/codeql-action"},{"name":"ossf/scorecard-action","old_version":"2.4.2","new_version":"2.4.3","repository_url":"https://github.com/ossf/scorecard-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the actions group with 9 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/checkout](https://github.com/actions/checkout) | `4` | `6` |\n| [jdx/mise-action](https://github.com/jdx/mise-action) | `2` | `4` |\n| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` |\n| [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action) | `17` | `23` |\n| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3` | `4` |\n| [docker/bake-action](https://github.com/docker/bake-action) | `6` | `7` |\n| [google/osv-scanner-action](https://github.com/google/osv-scanner-action) | `2.2.4` | `2.3.8` |\n| [github/codeql-action](https://github.com/github/codeql-action) | `3` | `4` |\n| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.2` | `2.4.3` |\n\n\nUpdates `actions/checkout` from 4 to 6\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/releases\"\u003eactions/checkout's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ev6-beta by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2298\"\u003eactions/checkout#2298\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate readme/changelog for v6 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2311\"\u003eactions/checkout#2311\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v5.0.0...v6.0.0\"\u003ehttps://github.com/actions/checkout/compare/v5.0.0...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6-beta\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eUpdated persist-credentials to store the credentials under \u003ccode\u003e$RUNNER_TEMP\u003c/code\u003e instead of directly in the local git config.\u003c/p\u003e\n\u003cp\u003eThis requires a minimum Actions Runner version of \u003ca href=\"https://github.com/actions/runner/releases/tag/v2.329.0\"\u003ev2.329.0\u003c/a\u003e to access the persisted credentials for \u003ca href=\"https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action\"\u003eDocker container action\u003c/a\u003e scenarios.\u003c/p\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v5...v5.0.1\"\u003ehttps://github.com/actions/checkout/compare/v5...v5.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare v5.0.0 release by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2238\"\u003eactions/checkout#2238\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e⚠️ Minimum Compatible Runner Version\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003ev2.327.1\u003c/strong\u003e\u003cbr /\u003e\n\u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003eRelease Notes\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eMake sure your runner is updated to this version or newer to use this release.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v4...v5.0.0\"\u003ehttps://github.com/actions/checkout/compare/v4...v5.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.3.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v4 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2305\"\u003eactions/checkout#2305\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v4...v4.3.1\"\u003ehttps://github.com/actions/checkout/compare/v4...v4.3.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update README.md by \u003ca href=\"https://github.com/motss\"\u003e\u003ccode\u003e@​motss\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1971\"\u003eactions/checkout#1971\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd internal repos for checking out multiple repositories by \u003ca href=\"https://github.com/mouismail\"\u003e\u003ccode\u003e@​mouismail\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1977\"\u003eactions/checkout#1977\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation update - add recommended permissions to Readme by \u003ca href=\"https://github.com/benwells\"\u003e\u003ccode\u003e@​benwells\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2043\"\u003eactions/checkout#2043\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/de0fac2e4500dabe0009e67214ff5f5447ce83dd\"\u003e\u003ccode\u003ede0fac2\u003c/code\u003e\u003c/a\u003e Fix tag handling: preserve annotations and explicit fetch-tags (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2356\"\u003e#2356\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/064fe7f3312418007dea2b49a19844a9ee378f49\"\u003e\u003ccode\u003e064fe7f\u003c/code\u003e\u003c/a\u003e Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/8e8c483db84b4bee98b60c0593521ed34d9990e8\"\u003e\u003ccode\u003e8e8c483\u003c/code\u003e\u003c/a\u003e Clarify v6 README (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2328\"\u003e#2328\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/033fa0dc0b82693d8986f1016a0ec2c5e7d9cbb1\"\u003e\u003ccode\u003e033fa0d\u003c/code\u003e\u003c/a\u003e Add worktree support for persist-credentials includeIf (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2327\"\u003e#2327\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5\"\u003e\u003ccode\u003ec2d88d3\u003c/code\u003e\u003c/a\u003e Update all references from v5 and v4 to v6 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2314\"\u003e#2314\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3\"\u003e\u003ccode\u003e1af3b93\u003c/code\u003e\u003c/a\u003e update readme/changelog for v6 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2311\"\u003e#2311\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/71cf2267d89c5cb81562390fa70a37fa40b1305e\"\u003e\u003ccode\u003e71cf226\u003c/code\u003e\u003c/a\u003e v6-beta (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2298\"\u003e#2298\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/069c6959146423d11cd0184e6accf28f9d45f06e\"\u003e\u003ccode\u003e069c695\u003c/code\u003e\u003c/a\u003e Persist creds to a separate file (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2286\"\u003e#2286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493\"\u003e\u003ccode\u003eff7abcd\u003c/code\u003e\u003c/a\u003e Update README to include Node.js 24 support details and requirements (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2248\"\u003e#2248\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/08c6903cd8c0fde910a37f88322edcfb5dd907a8\"\u003e\u003ccode\u003e08c6903\u003c/code\u003e\u003c/a\u003e Prepare v5.0.0 release (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2238\"\u003e#2238\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/checkout/compare/v4...v6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `jdx/mise-action` from 2 to 4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jdx/mise-action/releases\"\u003ejdx/mise-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.0.0: Node.js 24 Runtime\u003c/h2\u003e\n\u003cp\u003eA major version bump that updates the action's runtime from Node.js 20 to Node.js 24. GitHub has deprecated Node.js 20 for Actions and will force Node.js 24 as the default starting June 2, 2026. This release proactively adopts the new runtime to eliminate deprecation warnings and ensure continued compatibility.\u003c/p\u003e\n\u003ch2\u003eBreaking Changes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe action now runs on the \u003cstrong\u003eNode.js 24\u003c/strong\u003e runtime instead of Node.js 20. If your workflow pins \u003ccode\u003ejdx/mise-action@v3\u003c/code\u003e, you will continue to see deprecation warnings. Update to \u003ccode\u003ejdx/mise-action@v4\u003c/code\u003e to resolve them:\u003c/p\u003e\n\u003cpre lang=\"yaml\"\u003e\u003ccode\u003e- uses: jdx/mise-action@v4\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eThis should be a seamless upgrade for the vast majority of users — no configuration changes are needed beyond updating the version reference.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eChanged\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated GitHub Actions runtime from Node.js 20 to Node.js 24 by \u003ca href=\"https://github.com/tumerorkun\"\u003e\u003ccode\u003e@​tumerorkun\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/395\"\u003e#395\u003c/a\u003e (fixes \u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/394\"\u003e#394\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tumerorkun\"\u003e\u003ccode\u003e@​tumerorkun\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/395\"\u003e#395\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/jdx/mise-action/compare/v3...v4.0.0\"\u003ehttps://github.com/jdx/mise-action/compare/v3...v4.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.6.3\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: pass cwd to all exec calls in exportMiseEnv() by \u003ca href=\"https://github.com/andrewthauer\"\u003e\u003ccode\u003e@​andrewthauer\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/390\"\u003ejdx/mise-action#390\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: release v3.6.3 by \u003ca href=\"https://github.com/mise-en-dev\"\u003e\u003ccode\u003e@​mise-en-dev\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/391\"\u003ejdx/mise-action#391\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/andrewthauer\"\u003e\u003ccode\u003e@​andrewthauer\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/390\"\u003ejdx/mise-action#390\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/jdx/mise-action/compare/v3.6.2...v3.6.3\"\u003ehttps://github.com/jdx/mise-action/compare/v3.6.2...v3.6.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.6.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): update dependency prettier to v3.8.1 by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/368\"\u003ejdx/mise-action#368\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency \u003ccode\u003e@​types/node\u003c/code\u003e to v24.10.9 by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/367\"\u003ejdx/mise-action#367\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update github/codeql-action digest to 439137e by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/370\"\u003ejdx/mise-action#370\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): lock file maintenance by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/372\"\u003ejdx/mise-action#372\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update autofix-ci/action digest to 7a166d7 by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/375\"\u003ejdx/mise-action#375\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update actions/checkout digest to de0fac2 by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/374\"\u003ejdx/mise-action#374\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): lock file maintenance by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/377\"\u003ejdx/mise-action#377\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update github/codeql-action digest to b5ebac6 by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/378\"\u003ejdx/mise-action#378\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency \u003ccode\u003e@​types/node\u003c/code\u003e to v24.10.13 by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/379\"\u003ejdx/mise-action#379\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update github/codeql-action digest to f5c2471 by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/380\"\u003ejdx/mise-action#380\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: move file_hash to end of cache key template to prevent prefix matching by \u003ca href=\"https://github.com/altendky\"\u003e\u003ccode\u003e@​altendky\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/384\"\u003ejdx/mise-action#384\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency \u003ccode\u003e@​types/handlebars\u003c/code\u003e to v4.1.0 by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/381\"\u003ejdx/mise-action#381\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): lock file maintenance by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/386\"\u003ejdx/mise-action#386\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update github/codeql-action digest to 4558047 by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/387\"\u003ejdx/mise-action#387\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): lock file maintenance by \u003ca href=\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/389\"\u003ejdx/mise-action#389\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: release v3.6.2 by \u003ca href=\"https://github.com/mise-en-dev\"\u003e\u003ccode\u003e@​mise-en-dev\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/385\"\u003ejdx/mise-action#385\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jdx/mise-action/blob/main/CHANGELOG.md\"\u003ejdx/mise-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/jdx/mise-action/compare/v4.0.0..v4.0.1\"\u003e4.0.1\u003c/a\u003e - 2026-03-22\u003c/h2\u003e\n\u003ch3\u003e🐛 Bug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003erun npm install in pre-commit hook before build (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/410\"\u003e#410\u003c/a\u003e) by \u003ca href=\"https://github.com/jdx\"\u003e\u003ccode\u003e@​jdx\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/410\"\u003e#410\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e🚜 Refactor\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eextract getCwd() helper to deduplicate working directory resolution (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/403\"\u003e#403\u003c/a\u003e) by \u003ca href=\"https://github.com/altendky\"\u003e\u003ccode\u003e@​altendky\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/403\"\u003e#403\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e📚 Documentation\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebump versions listed im README.md (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/407\"\u003e#407\u003c/a\u003e) by \u003ca href=\"https://github.com/deining\"\u003e\u003ccode\u003e@​deining\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/407\"\u003e#407\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebump more versions listed in README.md (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/408\"\u003e#408\u003c/a\u003e) by \u003ca href=\"https://github.com/deining\"\u003e\u003ccode\u003e@​deining\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/408\"\u003e#408\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e⚙️ Miscellaneous Tasks\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eadd workflow to auto-close stale PRs (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/409\"\u003e#409\u003c/a\u003e) by \u003ca href=\"https://github.com/jdx\"\u003e\u003ccode\u003e@​jdx\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/409\"\u003e#409\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eNew Contributors\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/deining\"\u003e\u003ccode\u003e@​deining\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/408\"\u003e#408\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/jdx/mise-action/compare/v3.6.3..v4.0.0\"\u003e4.0.0\u003c/a\u003e - 2026-03-13\u003c/h2\u003e\n\u003ch3\u003e🚀 Features\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ebreaking\u003c/strong\u003e Update Node.js version from 20 to 24 (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/395\"\u003e#395\u003c/a\u003e) by \u003ca href=\"https://github.com/tumerorkun\"\u003e\u003ccode\u003e@​tumerorkun\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/395\"\u003e#395\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eNew Contributors\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tumerorkun\"\u003e\u003ccode\u003e@​tumerorkun\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/395\"\u003e#395\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/jdx/mise-action/compare/v3.6.2..v3.6.3\"\u003e3.6.3\u003c/a\u003e - 2026-03-06\u003c/h2\u003e\n\u003ch3\u003e🐛 Bug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003epass cwd to all exec calls in exportMiseEnv() (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/390\"\u003e#390\u003c/a\u003e) by \u003ca href=\"https://github.com/andrewthauer\"\u003e\u003ccode\u003e@​andrewthauer\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/390\"\u003e#390\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eNew Contributors\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/andrewthauer\"\u003e\u003ccode\u003e@​andrewthauer\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/jdx/mise-action/pull/390\"\u003e#390\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/jdx/mise-action/compare/v3.6.1..v3.6.2\"\u003e3.6.2\u003c/a\u003e - 2026-03-02\u003c/h2\u003e\n\u003ch3\u003e🐛 Bug Fixes\u003c/h3\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jdx/mise-action/commit/1648a7812b9aeae629881980618f079932869151\"\u003e\u003ccode\u003e1648a78\u003c/code\u003e\u003c/a\u003e chore: release v4.0.1 (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/406\"\u003e#406\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jdx/mise-action/commit/e2d499cca69a193bf3a0996426c5b3ccb94b2c97\"\u003e\u003ccode\u003ee2d499c\u003c/code\u003e\u003c/a\u003e ci: add workflow to auto-close stale PRs (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/409\"\u003e#409\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jdx/mise-action/commit/0cc0f1903615c9dac89b7dea8a31a86bfd9dab51\"\u003e\u003ccode\u003e0cc0f19\u003c/code\u003e\u003c/a\u003e fix: run npm install in pre-commit hook before build (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/410\"\u003e#410\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jdx/mise-action/commit/89c67a39ab4d727fde43e3f8f0f810d8202d34e8\"\u003e\u003ccode\u003e89c67a3\u003c/code\u003e\u003c/a\u003e docs: bump more versions listed in README.md (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/408\"\u003e#408\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jdx/mise-action/commit/0409dde834f41cd7d184340824f5557970508db8\"\u003e\u003ccode\u003e0409dde\u003c/code\u003e\u003c/a\u003e docs: bump versions listed im README.md (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/407\"\u003e#407\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jdx/mise-action/commit/abadabdb1fdc80cf6563f9bd749bf473c860bb5e\"\u003e\u003ccode\u003eabadabd\u003c/code\u003e\u003c/a\u003e refactor: extract getCwd() helper to deduplicate working directory resolution...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jdx/mise-action/commit/c5b2043e51040594ce6979ffd7d682ebbcada18c\"\u003e\u003ccode\u003ec5b2043\u003c/code\u003e\u003c/a\u003e chore(deps): update github/codeql-action digest to 603b797 (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/404\"\u003e#404\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jdx/mise-action/commit/71c0f0ac17abbafcd73c2c637b6f7a5c2c8162c1\"\u003e\u003ccode\u003e71c0f0a\u003c/code\u003e\u003c/a\u003e chore(deps): lock file maintenance (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/400\"\u003e#400\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jdx/mise-action/commit/c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4\"\u003e\u003ccode\u003ec1ecc8f\u003c/code\u003e\u003c/a\u003e chore: release v4.0.0 (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/398\"\u003e#398\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jdx/mise-action/commit/1cbe8c560f203f9ab4eaaf8a3064a85ee965298b\"\u003e\u003ccode\u003e1cbe8c5\u003c/code\u003e\u003c/a\u003e chore(deps): update github/codeql-action digest to 820e316 (\u003ca href=\"https://redirect.github.com/jdx/mise-action/issues/397\"\u003e#397\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/jdx/mise-action/compare/v2...v4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/upload-artifact` from 4 to 7\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/upload-artifact/releases\"\u003eactions/upload-artifact's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003ev7 What's new\u003c/h2\u003e\n\u003ch3\u003eDirect Uploads\u003c/h3\u003e\n\u003cp\u003eAdds support for uploading single files directly (unzipped). Callers can set the new \u003ccode\u003earchive\u003c/code\u003e parameter to \u003ccode\u003efalse\u003c/code\u003e to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The \u003ccode\u003ename\u003c/code\u003e parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.\u003c/p\u003e\n\u003ch3\u003eESM\u003c/h3\u003e\n\u003cp\u003eTo support new versions of the \u003ccode\u003e@actions/*\u003c/code\u003e packages, we've upgraded the package to ESM.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd proxy integration test by \u003ca href=\"https://github.com/Link\"\u003e\u003ccode\u003e@​Link\u003c/code\u003e\u003c/a\u003e- in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/754\"\u003eactions/upload-artifact#754\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade the module to ESM and bump dependencies by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/762\"\u003eactions/upload-artifact#762\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport direct file uploads by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/764\"\u003eactions/upload-artifact#764\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Link\"\u003e\u003ccode\u003e@​Link\u003c/code\u003e\u003c/a\u003e- made their first contribution in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/754\"\u003eactions/upload-artifact#754\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-artifact/compare/v6...v7.0.0\"\u003ehttps://github.com/actions/upload-artifact/compare/v6...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003ev6 - What's new\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!IMPORTANT]\nactions/upload-artifact@v6 now runs on Node.js 24 (\u003ccode\u003eruns.using: node24\u003c/code\u003e) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch3\u003eNode.js 24\u003c/h3\u003e\n\u003cp\u003eThis release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpload Artifact Node 24 support by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/719\"\u003eactions/upload-artifact#719\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update \u003ccode\u003e@​actions/artifact\u003c/code\u003e for Node.js 24 punycode deprecation by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/744\"\u003eactions/upload-artifact#744\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eprepare release v6.0.0 for Node.js 24 support by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/745\"\u003eactions/upload-artifact#745\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0\"\u003ehttps://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBREAKING CHANGE:\u003c/strong\u003e this update supports Node \u003ccode\u003ev24.x\u003c/code\u003e. This is not a breaking change per-se but we're treating it as such.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate README.md by \u003ca href=\"https://github.com/GhadimiR\"\u003e\u003ccode\u003e@​GhadimiR\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/681\"\u003eactions/upload-artifact#681\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca href=\"https://github.com/nebuk89\"\u003e\u003ccode\u003e@​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/712\"\u003eactions/upload-artifact#712\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReadme: spell out the first use of GHES by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/727\"\u003eactions/upload-artifact#727\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate GHES guidance to include reference to Node 20 version by \u003ca href=\"https://github.com/patrikpolyak\"\u003e\u003ccode\u003e@​patrikpolyak\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/725\"\u003eactions/upload-artifact#725\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/artifact\u003c/code\u003e to \u003ccode\u003ev4.0.0\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003ePrepare \u003ccode\u003ev5.0.0\u003c/code\u003e by \u003ca href=\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/upload-artifact/pull/734\"\u003eactions/upload-artifact#734\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a\"\u003e\u003ccode\u003e043fb46\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/797\"\u003e#797\u003c/a\u003e from actions/yacaovsnc/update-dependency\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/634250c1388765ea7ed0f053e636f1f399000b94\"\u003e\u003ccode\u003e634250c\u003c/code\u003e\u003c/a\u003e Include changes in typespec/ts-http-runtime 0.3.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/e454baaac2be505c9450e11b8f3215c6fc023ce8\"\u003e\u003ccode\u003ee454baa\u003c/code\u003e\u003c/a\u003e Readme: bump all the example versions to v7 (\u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/796\"\u003e#796\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/74fad66b98a6d799dc004d3353ccd0e6f6b2530e\"\u003e\u003ccode\u003e74fad66\u003c/code\u003e\u003c/a\u003e Update the readme with direct upload details (\u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/795\"\u003e#795\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f\"\u003e\u003ccode\u003ebbbca2d\u003c/code\u003e\u003c/a\u003e Support direct file uploads (\u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/764\"\u003e#764\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/589182c5a4cec8920b8c1bce3e2fab1c97a02296\"\u003e\u003ccode\u003e589182c\u003c/code\u003e\u003c/a\u003e Upgrade the module to ESM and bump dependencies (\u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/762\"\u003e#762\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/47309c993abb98030a35d55ef7ff34b7fa1074b5\"\u003e\u003ccode\u003e47309c9\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/754\"\u003e#754\u003c/a\u003e from actions/Link-/add-proxy-integration-tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/02a8460834e70dab0ce194c64360c59dc1475ef0\"\u003e\u003ccode\u003e02a8460\u003c/code\u003e\u003c/a\u003e Add proxy integration test\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/b7c566a772e6b6bfb58ed0dc250532a479d7789f\"\u003e\u003ccode\u003eb7c566a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/upload-artifact/issues/745\"\u003e#745\u003c/a\u003e from actions/upload-artifact-v6-release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/upload-artifact/commit/e516bc8500aaf3d07d591fcd4ae6ab5f9c391d5b\"\u003e\u003ccode\u003ee516bc8\u003c/code\u003e\u003c/a\u003e docs: correct description of Node.js 24 support in README\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/upload-artifact/compare/v4...v7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `DavidAnson/markdownlint-cli2-action` from 17 to 23\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/davidanson/markdownlint-cli2-action/releases\"\u003eDavidAnson/markdownlint-cli2-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eUpdate markdownlint-cli2 version (markdownlint-cli2 v0.22.1, markdownlint v0.40.0).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint-cli2 version (markdownlint-cli2 v0.22.0, markdownlint v0.40.0), update Node.js dependency to 24.\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.20.0, markdownlint v0.40.0).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.19.0, markdownlint v0.39.0).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.18.1, markdownlint v0.38.0).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.17.2, markdownlint v0.37.4).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.17.0, markdownlint v0.37.0).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.15.0, markdownlint v0.36.1).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.14.0, markdownlint v0.35.0).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.13.0, markdownlint v0.34.0).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003cp\u003eUpdate markdownlint version (markdownlint-cli2 v0.12.1, markdownlint v0.33.0).\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.11.0, markdownlint v0.32.1), remove deprecated \u0026quot;command\u0026quot; input.\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.10.0, markdownlint v0.31.1).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.9.2, markdownlint v0.30.0).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.8.1, markdownlint v0.29.0), add \u0026quot;config\u0026quot; and \u0026quot;fix\u0026quot; inputs, deprecate \u0026quot;command\u0026quot; input.\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.7.1, markdownlint v0.28.2).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003eUpdate markdownlint version (markdownlint-cli2 v0.7.0, markdownlint v0.28.1), include link to rule information in title of annotations (clickable in GitHub).\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DavidAnson/markdownlint-cli2-action/commit/ded1f9488f68a970bc66ea5619e13e9b52e601cd\"\u003e\u003ccode\u003eded1f94\u003c/code\u003e\u003c/a\u003e Update to version 23.2.0.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DavidAnson/markdownlint-cli2-action/commit/dc5dad9f8ba073d9c126e0d851df92a6d37edf73\"\u003e\u003ccode\u003edc5dad9\u003c/code\u003e\u003c/a\u003e Add 10-day cooldown period to Dependabot updates.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DavidAnson/markdownlint-cli2-action/commit/64b1c6ae183a8eb20a1aa3953e30a9dd4d432402\"\u003e\u003ccode\u003e64b1c6a\u003c/code\u003e\u003c/a\u003e Add package-lock.json for reproducible builds (fixes \u003ca href=\"https://redirect.github.com/davidanson/markdownlint-cli2-action/issues/362\"\u003e#362\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DavidAnson/markdownlint-cli2-action/commit/6c62e06b9a7e92ae00b281d5c6794123911021af\"\u003e\u003ccode\u003e6c62e06\u003c/code\u003e\u003c/a\u003e Bump eslint-plugin-n from 17.24.0 to 18.0.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DavidAnson/markdownlint-cli2-action/commit/9b5720cdbb216ebfd0f8ebfcd1b213c83ed1b206\"\u003e\u003ccode\u003e9b5720c\u003c/code\u003e\u003c/a\u003e Bump eslint from 10.2.1 to 10.3.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DavidAnson/markdownlint-cli2-action/commit/6b51ade7a9e4a75a7ad929842dd298a3804ebe8b\"\u003e\u003ccode\u003e6b51ade\u003c/code\u003e\u003c/a\u003e Update to version 23.1.0.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DavidAnson/markdownlint-cli2-action/commit/ea6e0dad81a67897db7632a0a41b3a0e7cc03ca3\"\u003e\u003ccode\u003eea6e0da\u003c/code\u003e\u003c/a\u003e Freshen generated index.js file.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DavidAnson/markdownlint-cli2-action/commit/3c4c2c842cd43c2afe7cb5f2ecfe9e1623fa8d14\"\u003e\u003ccode\u003e3c4c2c8\u003c/code\u003e\u003c/a\u003e Bump markdownlint-cli2 from 0.22.0 to 0.22.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DavidAnson/markdownlint-cli2-action/commit/3a933d45e20b54b80131d0335d61186e63e552bd\"\u003e\u003ccode\u003e3a933d4\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e@​actions/core\u003c/code\u003e from 3.0.0 to 3.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DavidAnson/markdownlint-cli2-action/commit/648042e2afed596b673a8b3f8fc8fbfb48b41f43\"\u003e\u003ccode\u003e648042e\u003c/code\u003e\u003c/a\u003e Freshen generated index.js file.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/davidanson/markdownlint-cli2-action/compare/v17...v23\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `docker/setup-buildx-action` from 3 to 4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/docker/setup-buildx-action/releases\"\u003edocker/setup-buildx-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eNode 24 as default runtime (requires \u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003eActions Runner v2.327.1\u003c/a\u003e or later) by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/483\"\u003edocker/setup-buildx-action#483\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove deprecated inputs/outputs by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/464\"\u003edocker/setup-buildx-action#464\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSwitch to ESM and update config/test wiring by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/481\"\u003edocker/setup-buildx-action#481\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e from 1.11.1 to 3.0.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/475\"\u003edocker/setup-buildx-action#475\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.63.0 to 0.79.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/482\"\u003edocker/setup-buildx-action#482\u003c/a\u003e \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/485\"\u003edocker/setup-buildx-action#485\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.0 to 4.1.1 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/452\"\u003edocker/setup-buildx-action#452\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump lodash from 4.17.21 to 4.17.23 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/472\"\u003edocker/setup-buildx-action#472\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump minimatch from 3.1.2 to 3.1.5 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/480\"\u003edocker/setup-buildx-action#480\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/v3.12.0...v4.0.0\"\u003ehttps://github.com/docker/setup-buildx-action/compare/v3.12.0...v4.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.12.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeprecate \u003ccode\u003einstall\u003c/code\u003e input by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/455\"\u003edocker/setup-buildx-action#455\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.62.1 to 0.63.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/434\"\u003edocker/setup-buildx-action#434\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump brace-expansion from 1.1.11 to 1.1.12 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/436\"\u003edocker/setup-buildx-action#436\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump form-data from 2.5.1 to 2.5.5 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/432\"\u003edocker/setup-buildx-action#432\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 5.28.4 to 5.29.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/435\"\u003edocker/setup-buildx-action#435\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/v3.11.1...v3.12.0\"\u003ehttps://github.com/docker/setup-buildx-action/compare/v3.11.1...v3.12.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.11.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix \u003ccode\u003ekeep-state\u003c/code\u003e not being respected by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/429\"\u003edocker/setup-buildx-action#429\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/v3.11.0...v3.11.1\"\u003ehttps://github.com/docker/setup-buildx-action/compare/v3.11.0...v3.11.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.11.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eKeep BuildKit state support by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/427\"\u003edocker/setup-buildx-action#427\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove aliases created when installing by default by \u003ca href=\"https://github.com/hashhar\"\u003e\u003ccode\u003e@​hashhar\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/139\"\u003edocker/setup-buildx-action#139\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.56.0 to 0.62.1 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/422\"\u003edocker/setup-buildx-action#422\u003c/a\u003e \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/425\"\u003edocker/setup-buildx-action#425\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/v3.10.0...v3.11.0\"\u003ehttps://github.com/docker/setup-buildx-action/compare/v3.10.0...v3.11.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.10.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.54.0 to 0.56.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/408\"\u003edocker/setup-buildx-action#408\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/v3.9.0...v3.10.0\"\u003ehttps://github.com/docker/setup-buildx-action/compare/v3.9.0...v3.10.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.9.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.48.0 to 0.54.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/402\"\u003edocker/setup-buildx-action#402\u003c/a\u003e \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/404\"\u003edocker/setup-buildx-action#404\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/v3.8.0...v3.9.0\"\u003ehttps://github.com/docker/setup-buildx-action/compare/v3.8.0...v3.9.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.8.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMake cloud prefix optional to download buildx if driver is cloud by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/390\"\u003edocker/setup-buildx-action#390\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e from 1.10.1 to 1.11.1 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/370\"\u003edocker/setup-buildx-action#370\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.39.0 to 0.48.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/389\"\u003edocker/setup-buildx-action#389\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump cross-spawn from 7.0.3 to 7.0.6 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/382\"\u003edocker/setup-buildx-action#382\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/v3.7.1...v3.8.0\"\u003ehttps://github.com/docker/setup-buildx-action/compare/v3.7.1...v3.8.0\u003c/a\u003e\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5\"\u003e\u003ccode\u003ed7f5e7f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/489\"\u003e#489\u003c/a\u003e from docker/dependabot/npm_and_yarn/docker/actions-to...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/92bc5c9777806d0a73d9d668ba2114fa1177f164\"\u003e\u003ccode\u003e92bc5c9\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/da11e35abee0f20cb4f1c1b7c461d37c29be52f5\"\u003e\u003ccode\u003eda11e35\u003c/code\u003e\u003c/a\u003e build(deps): bump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.79.0 to 0.90.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/f021e162ef95b6fba51af1c6674f537f25bce851\"\u003e\u003ccode\u003ef021e16\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/492\"\u003e#492\u003c/a\u003e from docker/dependabot/npm_and_yarn/undici-6.24.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/b5af94fab700aee0c64d6077e0e34ae987815b67\"\u003e\u003ccode\u003eb5af94f\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/16ad9776a801d0c47f0a05f007b88a3789aa8ab6\"\u003e\u003ccode\u003e16ad977\u003c/code\u003e\u003c/a\u003e build(deps): bump undici from 6.23.0 to 6.25.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/d7a12d7df895b33bd02a9b4bf62a12f2b9a24458\"\u003e\u003ccode\u003ed7a12d7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/495\"\u003e#495\u003c/a\u003e from docker/dependabot/npm_and_yarn/glob-10.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/28ff27de4eed7518d361591f2cd1dfb69c34a7cb\"\u003e\u003ccode\u003e28ff27d\u003c/code\u003e\u003c/a\u003e build(deps): bump glob from 10.3.12 to 13.0.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/daf436b50e13d9053b9730cbc16516891878b019\"\u003e\u003ccode\u003edaf436b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/496\"\u003e#496\u003c/a\u003e from docker/dependabot/npm_and_yarn/fast-xml-parser-5...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/9725348367859764880f2f2e688a6b0c353e3f35\"\u003e\u003ccode\u003e9725348\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/v3...v4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `docker/bake-action` from 6 to 7\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/docker/bake-action/releases\"\u003edocker/bake-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eNode 24 as default runtime (requires \u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003eActions Runner v2.327.1\u003c/a\u003e or later) by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/383\"\u003edocker/bake-action#383\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eworkdir\u003c/code\u003e input is now merged into \u003ccode\u003esource\u003c/code\u003e; use \u003ccode\u003esource\u003c/code\u003e for local and remote (\u003ca href=\"https://github.com/docker/bake-action?tab=readme-ov-file#source-semantics\"\u003edocs\u003c/a\u003e) by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/365\"\u003edocker/bake-action#365\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove deprecated \u003ccode\u003eDOCKER_BUILD_NO_SUMMARY\u003c/code\u003e and \u003ccode\u003eDOCKER_BUILD_EXPORT_RETENTION_DAYS\u003c/code\u003e envs by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/386\"\u003edocker/bake-action#386\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove legacy export-build tool support for build summary by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/387\"\u003edocker/bake-action#387\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove deprecated \u003ccode\u003elist-targets\u003c/code\u003e subaction (use \u003ca href=\"https://github.com/docker/bake-action/tree/master/subaction/matrix\"\u003e\u003ccode\u003ematrix\u003c/code\u003e subaction\u003c/a\u003e instead) by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/370\"\u003edocker/bake-action#370\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSwitch to ESM and update config/test wiring by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/380\"\u003edocker/bake-action#380\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e from 1.11.1 to 3.0.0 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/382\"\u003edocker/bake-action#382\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.68.0 to 0.79.0 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/381\"\u003edocker/bake-action#381\u003c/a\u003e \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/384\"\u003edocker/bake-action#384\u003c/a\u003e \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/389\"\u003edocker/bake-action#389\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​isaacs/brace-expansion\u003c/code\u003e from 5.0.0 to 5.0.1 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/379\"\u003edocker/bake-action#379\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump lodash from 4.17.21 to 4.17.23 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/376\"\u003edocker/bake-action#376\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/bake-action/compare/v6.10.0...v7.0.0\"\u003ehttps://github.com/docker/bake-action/compare/v6.10.0...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.10.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck provenance attestation set in bake definition before overriding by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/359\"\u003edocker/bake-action#359\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.63.0 to 0.68.0 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/360\"\u003edocker/bake-action#360\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 3.14.1 to 3.14.2 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/357\"\u003edocker/bake-action#357\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/bake-action/compare/v6.9.0...v6.10.0\"\u003ehttps://github.com/docker/bake-action/compare/v6.9.0...v6.10.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.9.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ca href=\"https://github.com/docker/bake-action/blob/master/subaction/matrix\"\u003e\u003ccode\u003ematrix\u003c/code\u003e\u003c/a\u003e subaction and deprecate \u003ccode\u003elist-targets\u003c/code\u003e by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/204\"\u003edocker/bake-action#204\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003ecall\u003c/code\u003e input to set method for evaluating build by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/338\"\u003edocker/bake-action#338\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.62.1 to 0.63.0 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/342\"\u003edocker/bake-action#342\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump brace-expansion from 1.1.11 to 1.1.12 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/339\"\u003edocker/bake-action#339\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump form-data from 2.5.1 to 2.5.5 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/334\"\u003edocker/bake-action#334\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump tmp from 0.2.3 to 0.2.4 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/341\"\u003edocker/bake-action#341\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 5.28.4 to 5.29.0 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/340\"\u003edocker/bake-action#340\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!IMPORTANT]\n\u003ca href=\"https://github.com/docker/bake-action/tree/v6.9.0/subaction/list-targets\"\u003e\u003ccode\u003edocker/bake-action/subaction/list-targets\u003c/code\u003e\u003c/a\u003e is deprecated and will be removed in a future release.\nPlease use \u003ca href=\"https://github.com/docker/bake-action/blob/master/subaction/matrix\"\u003e\u003ccode\u003edocker/bake-action/subaction/matrix\u003c/code\u003e\u003c/a\u003e instead.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/bake-action/compare/v6.8.0...v6.9.0\"\u003ehttps://github.com/docker/bake-action/compare/v6.8.0...v6.9.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.8.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.61.0 to 0.62.1 in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/331\"\u003edocker/bake-action#331\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!NOTE]\n\u003ca href=\"https://docs.docker.com/build/ci/github-actions/build-summary/\"\u003eBuild summary\u003c/a\u003e is now supported with \u003ca href=\"https://docs.docker.com/build-cloud/\"\u003eDocker Build Cloud\u003c/a\u003e.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/bake-action/compare/v6.7.0...v6.8.0\"\u003ehttps://github.com/docker/bake-action/compare/v6.7.0...v6.8.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.7.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.59.0 to 0.61.0 by \u003ca href=\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/docker/bake-action/pull/325\"\u003edocker/bake-action#325\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!NOTE]\nBuild record is now exported using the \u003ca href=\"https://docs.docker.com/reference/cli/docker/buildx/history/export/\"\u003e\u003ccode\u003ebuildx history export\u003c/code\u003e\u003c/a\u003e command instead of the legacy export-build tool.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/bake-action/commit/6614cfa25eff9a0b2b2697efb0b6159e7680d584\"\u003e\u003ccode\u003e6614cfa\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/bake-action/issues/425\"\u003e#425\u003c/a\u003e from docker/dependabot/npm_and_yarn/docker/actions-to...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/bake-action/commit/0a925a2f441ed5b98093a5f22bf394d4f7f90fe1\"\u003e\u003ccode\u003e0a925a2\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/bake-action/commit/b9ca7428b9db7ce99fd53cbb841e7fe2e4398e14\"\u003e\u003ccode\u003eb9ca742\u003c/code\u003e\u003c/a\u003e chore(deps): Bump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.87.0 to 0.90.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/bake-action/commit/48e6359a4a84f8878f508f6b40522cec98458a84\"\u003e\u003ccode\u003e48e6359\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/bake-action/issues/429\"\u003e#429\u003c/a\u003e from docker/dependabot/npm_and_yarn/fast-xml-parser-5...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/bake-action/commit/d1523f495ad477e665fb3791b34ebf03cd94a84a\"\u003e\u003ccode\u003ed1523f4\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/bake-action/commit/a73f293b0b9bee84f5b67dea49ed4df47bcb7ec5\"\u003e\u003ccode\u003ea73f293\u003c/code\u003e\u003c/a\u003e chore(deps): Bump fast-xml-parser from 5.5.9 to 5.8.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/bake-action/commit/bc584acc2abd0dcd4af6aa2d22c8d8fe0c1a1b3e\"\u003e\u003ccode\u003ebc584ac\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/bake-action/issues/430\"\u003e#430\u003c/a\u003e from docker/dependabot/npm_and_yarn/actions/core-3.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/bake-action/commit/23050a11b3ba889f5d9d8661ab17ae5bd50ce163\"\u003e\u003ccode\u003e23050a1\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/bake-action/commit/7ae1cf6599093238db3b9873f3591f3c566d9840\"\u003e\u003ccode\u003e7ae1cf6\u003c/code\u003e\u003c/a\u003e chore(deps): Bump \u003ccode\u003e@​actions/core\u003c/code\u003e from 3.0.0 to 3.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/bake-action/commit/e7934f83947a97c36e6e96d97ec3f299d987c7b8\"\u003e\u003ccode\u003ee7934f8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/bake-action/issues/432\"\u003e#432\u003c/a\u003e from docker/dependabot/npm_and_yarn/postcss-8.5.10\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/docker/bake-action/compare/v6...v7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action` from 2.2.4 to 2.3.8\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.5\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.5.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to v2.3.5 by \u003ca href=\"https://github.com/tobyhawker\"\u003e\u003ccode\u003e@​tobyhawker\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/124\"\u003egoogle/osv-scanner-action#124\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tobyhawker\"\u003e\u003ccode\u003e@​tobyhawker\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/124\"\u003egoogle/osv-scanner-action#124\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.3...v2.3.5\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.3...v2.3.5\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.3\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.3.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): update github/codeql-action action to v4.31.10 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/115\"\u003egoogle/osv-scanner-action#115\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate to v2.3.3 by \u003ca href=\"https://github.com/Ly-Joey\"\u003e\u003ccode\u003e@​Ly-Joey\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/118\"\u003egoogle/osv-scanner-action#118\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Ly-Joey\"\u003e\u003ccode\u003e@​Ly-Joey\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/118\"\u003egoogle/osv-scanner-action#118\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.2...v2.3.3\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.2...v2.3.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.2\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.2\u003c/p\u003e\n\u003cp\u003eThis release includes performance improvements for local scanning, reducing memory usage and avoiding unnecessary advisory loading. It also fixes issues with MCP's get_vulnerability_details tool, git queries in \u003ccode\u003eosv-scanner.json\u003c/code\u003e, and ignore entry tracking, along with documentation updates.\u003c/p\u003e\n\u003ch3\u003eFixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2415\"\u003e#2415\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2415\"\u003egoogle/osv-scanner#2415\u003c/a\u003e) Add more PURL-to-ecosystem mappings\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2422\"\u003e#2422\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2422\"\u003egoogle/osv-scanner#2422\u003c/a\u003e) MCP error for get_vulnerability_id because type definition is incorrect.\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2460\"\u003e#2460\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2460\"\u003egoogle/osv-scanner#2460\u003c/a\u003e) Enable osv-scanner.json git queries\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2456\"\u003e#2456\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2456\"\u003egoogle/osv-scanner#2456\u003c/a\u003e) Properly track if an ignore entry has been used\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2450\"\u003e#2450\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2450\"\u003egoogle/osv-scanner#2450\u003c/a\u003e) \u003cstrong\u003ePerformance:\u003c/strong\u003e Avoid loading the entire advisory unless it will actually be used\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2445\"\u003e#2445\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2445\"\u003egoogle/osv-scanner#2445\u003c/a\u003e) \u003cstrong\u003ePerformance:\u003c/strong\u003e Don't read the entire zip into memory\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2433\"\u003e#2433\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2433\"\u003egoogle/osv-scanner#2433\u003c/a\u003e) Allow specifying user agent in v2 osvscanner package\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMisc:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e[Misc \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2453\"\u003e#2453\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2453\"\u003egoogle/osv-scanner#2453\u003c/a\u003e) Switch from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3\u003c/li\u003e\n\u003cli\u003e[Misc \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2447\"\u003e#2447\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2447\"\u003egoogle/osv-scanner#2447\u003c/a\u003e) Include \u003ccode\u003ebun.lock\u003c/code\u003e as a supported lockfile\u003c/li\u003e\n\u003cli\u003e[Misc \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2444\"\u003e#2444\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2444\"\u003egoogle/osv-scanner#2444\u003c/a\u003e) Document GoVersionOverride in configuration.md\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9517144e5504957104c831530fe605bfdc71f353\"\u003e\u003ccode\u003e9517144\u003c/code\u003e\u003c/a\u003e feat: output results in reusable workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f17cd09224d6ef8be953fb49371e6bffb2dbf44a\"\u003e\u003ccode\u003ef17cd09\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into main\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.2.4...v2.3.8\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action` from 3 to 4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.36.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.19.4. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev3.35.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal \u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will be enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for GitHub-internal use only, and may change without notice at any time. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning analysis for a PR with \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev3.35.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev3.35.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP OIDC are now accepted. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBest-effort connection tests for private registries now use \u003ccode\u003eGET\u003c/code\u003e requests instead of \u003ccode\u003eHEAD\u003c/code\u003e for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3853\"\u003e#3853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3\"\u003e2.25.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3865\"\u003e#3865\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev3.35.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe undocumented TRAP cache cleanup feature that could be enabled using the \u003ccode\u003eCODEQL_ACTION_CLEANUP_TRAP_CACHES\u003c/code\u003e environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the \u003ccode\u003etrap-caching: false\u003c/code\u003e input to the \u003ccode\u003einit\u003c/code\u003e Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3795\"\u003e#3795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3789\"\u003e#3789\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePython analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3794\"\u003e#3794\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3807\"\u003e#3807\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2\"\u003e2.25.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3823\"\u003e#3823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev3.35.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix incorrect minimum required Git version for \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e: it should have been 2.36.0, not 2.11.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3781\"\u003e#3781\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev3.35.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReduced the minimum Git version required for \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e from 2.38.0 to 2.11.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3767\"\u003e#3767\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1\"\u003e2.25.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3773\"\u003e#3773\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev3.34.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDowngrade default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3\"\u003e2.24.3\u003c/a\u003e due to issues with a small percentage of Actions and JavaScript analyses. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3762\"\u003e#3762\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev3.34.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded an experimental change which disables TRAP caching...\n\n_Description has been truncated_","html_url":"https://github.com/theagenticguy/agent-images/pull/4","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/theagenticguy%2Fagent-images/issues/4","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/4/packages"}},{"old_version":"2.3.5","new_version":"2.3.8","update_type":"patch","path":null,"pr_created_at":"2026-05-30T01:01:56.000Z","version_change":"2.3.5 → 2.3.8","issue":{"uuid":"4552609009","node_id":"PR_kwDOSe3Vr87g2yS6","number":3,"state":"open","title":"chore(deps): bump the github-actions group across 1 directory with 15 updates","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-05-30T01:01:56.000Z","updated_at":"2026-06-27T02:01:29.688Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"github-actions","update_count":15,"packages":[{"name":"actions/checkout","old_version":"3.1.0","new_version":"6.0.2","repository_url":"https://github.com/actions/checkout"},{"name":"step-security/harden-runner","old_version":"2.19.0","new_version":"2.19.4","repository_url":"https://github.com/step-security/harden-runner"},{"name":"golangci/golangci-lint-action","old_version":"9.2.0","new_version":"9.2.1","repository_url":"https://github.com/golangci/golangci-lint-action"},{"name":"codecov/codecov-action","old_version":"6.0.0","new_version":"6.0.1","repository_url":"https://github.com/codecov/codecov-action"},{"name":"github/codeql-action","old_version":"2.1.36","new_version":"4.36.0","repository_url":"https://github.com/github/codeql-action"},{"name":"actions/dependency-review-action","old_version":"4.9.0","new_version":"5.0.0","repository_url":"https://github.com/actions/dependency-review-action"},{"name":"goreleaser/goreleaser-action","old_version":"7.2.1","new_version":"7.2.2","repository_url":"https://github.com/goreleaser/goreleaser-action"},{"name":"actions/labeler","old_version":"6.0.1","new_version":"6.1.0","repository_url":"https://github.com/actions/labeler"},{"name":"google/osv-scanner-action","old_version":"2.3.5","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"release-drafter/release-drafter","old_version":"7.2.1","new_version":"7.3.1","repository_url":"https://github.com/release-drafter/release-drafter"},{"name":"sigstore/cosign-installer","old_version":"4.1.1","new_version":"4.1.2","repository_url":"https://github.com/sigstore/cosign-installer"},{"name":"docker/setup-qemu-action","old_version":"4.0.0","new_version":"4.1.0","repository_url":"https://github.com/docker/setup-qemu-action"},{"name":"docker/setup-buildx-action","old_version":"4.0.0","new_version":"4.1.0","repository_url":"https://github.com/docker/setup-buildx-action"},{"name":"docker/login-action","old_version":"4.1.0","new_version":"4.2.0","repository_url":"https://github.com/docker/login-action"},{"name":"crate-ci/typos","old_version":"1.45.2","new_version":"1.47.0","repository_url":"https://github.com/crate-ci/typos"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions group with 15 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/checkout](https://github.com/actions/checkout) | `3.1.0` | `6.0.2` |\n| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.19.0` | `2.19.4` |\n| [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `9.2.0` | `9.2.1` |\n| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `6.0.0` | `6.0.1` |\n| [github/codeql-action](https://github.com/github/codeql-action) | `2.1.36` | `4.36.0` |\n| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.9.0` | `5.0.0` |\n| [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `7.2.1` | `7.2.2` |\n| [actions/labeler](https://github.com/actions/labeler) | `6.0.1` | `6.1.0` |\n| [google/osv-scanner-action](https://github.com/google/osv-scanner-action) | `2.3.5` | `2.3.8` |\n| [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) | `7.2.1` | `7.3.1` |\n| [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `4.1.1` | `4.1.2` |\n| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `4.0.0` | `4.1.0` |\n| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.0.0` | `4.1.0` |\n| [docker/login-action](https://github.com/docker/login-action) | `4.1.0` | `4.2.0` |\n| [crate-ci/typos](https://github.com/crate-ci/typos) | `1.45.2` | `1.47.0` |\n\n\nUpdates `actions/checkout` from 3.1.0 to 6.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/releases\"\u003eactions/checkout's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by \u003ca href=\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2355\"\u003eactions/checkout#2355\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6.0.1...v6.0.2\"\u003ehttps://github.com/actions/checkout/compare/v6.0.1...v6.0.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all references from v5 and v4 to v6 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2314\"\u003eactions/checkout#2314\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eClarify v6 README by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2328\"\u003eactions/checkout#2328\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6...v6.0.1\"\u003ehttps://github.com/actions/checkout/compare/v6...v6.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ev6-beta by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2298\"\u003eactions/checkout#2298\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate readme/changelog for v6 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2311\"\u003eactions/checkout#2311\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v5.0.0...v6.0.0\"\u003ehttps://github.com/actions/checkout/compare/v5.0.0...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6-beta\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eUpdated persist-credentials to store the credentials under \u003ccode\u003e$RUNNER_TEMP\u003c/code\u003e instead of directly in the local git config.\u003c/p\u003e\n\u003cp\u003eThis requires a minimum Actions Runner version of \u003ca href=\"https://github.com/actions/runner/releases/tag/v2.329.0\"\u003ev2.329.0\u003c/a\u003e to access the persisted credentials for \u003ca href=\"https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action\"\u003eDocker container action\u003c/a\u003e scenarios.\u003c/p\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v5...v5.0.1\"\u003ehttps://github.com/actions/checkout/compare/v5...v5.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare v5.0.0 release by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2238\"\u003eactions/checkout#2238\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e⚠️ Minimum Compatible Runner Version\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003ev2.327.1\u003c/strong\u003e\u003cbr /\u003e\n\u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003eRelease Notes\u003c/a\u003e\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\"\u003eactions/checkout's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v4 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2305\"\u003eactions/checkout#2305\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update README.md by \u003ca href=\"https://github.com/motss\"\u003e\u003ccode\u003e@​motss\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1971\"\u003eactions/checkout#1971\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd internal repos for checking out multiple repositories by \u003ca href=\"https://github.com/mouismail\"\u003e\u003ccode\u003e@​mouismail\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1977\"\u003eactions/checkout#1977\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation update - add recommended permissions to Readme by \u003ca href=\"https://github.com/benwells\"\u003e\u003ccode\u003e@​benwells\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2043\"\u003eactions/checkout#2043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdjust positioning of user email note and permissions heading by \u003ca href=\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2044\"\u003eactions/checkout#2044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca href=\"https://github.com/nebuk89\"\u003e\u003ccode\u003e@​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2194\"\u003eactions/checkout#2194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate CODEOWNERS for actions by \u003ca href=\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2224\"\u003eactions/checkout#2224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate package dependencies by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2236\"\u003eactions/checkout#2236\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eurl-helper.ts\u003c/code\u003e now leverages well-known environment variables by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1941\"\u003eactions/checkout#1941\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpand unit test coverage for \u003ccode\u003eisGhes\u003c/code\u003e by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1946\"\u003eactions/checkout#1946\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck out other refs/* by commit if provided, fall back to ref by \u003ca href=\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1924\"\u003eactions/checkout#1924\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd Ref and Commit outputs by \u003ca href=\"https://github.com/lucacome\"\u003e\u003ccode\u003e@​lucacome\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1180\"\u003eactions/checkout#1180\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDependency updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e- \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1777\"\u003eactions/checkout#1777\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1872\"\u003eactions/checkout#1872\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.1.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1739\"\u003eactions/checkout#1739\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 3 to 4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1697\"\u003eactions/checkout#1697\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCheck out other refs/* by commit by \u003ca href=\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1774\"\u003eactions/checkout#1774\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin actions/checkout's own workflows to a known, good, stable version. by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1776\"\u003eactions/checkout#1776\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.1.6\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck platform to set archive extension appropriately by \u003ca href=\"https://github.com/cory-miller\"\u003e\u003ccode\u003e@​cory-miller\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1732\"\u003eactions/checkout#1732\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/de0fac2e4500dabe0009e67214ff5f5447ce83dd\"\u003e\u003ccode\u003ede0fac2\u003c/code\u003e\u003c/a\u003e Fix tag handling: preserve annotations and explicit fetch-tags (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2356\"\u003e#2356\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/064fe7f3312418007dea2b49a19844a9ee378f49\"\u003e\u003ccode\u003e064fe7f\u003c/code\u003e\u003c/a\u003e Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/8e8c483db84b4bee98b60c0593521ed34d9990e8\"\u003e\u003ccode\u003e8e8c483\u003c/code\u003e\u003c/a\u003e Clarify v6 README (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2328\"\u003e#2328\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/033fa0dc0b82693d8986f1016a0ec2c5e7d9cbb1\"\u003e\u003ccode\u003e033fa0d\u003c/code\u003e\u003c/a\u003e Add worktree support for persist-credentials includeIf (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2327\"\u003e#2327\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5\"\u003e\u003ccode\u003ec2d88d3\u003c/code\u003e\u003c/a\u003e Update all references from v5 and v4 to v6 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2314\"\u003e#2314\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3\"\u003e\u003ccode\u003e1af3b93\u003c/code\u003e\u003c/a\u003e update readme/changelog for v6 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2311\"\u003e#2311\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/71cf2267d89c5cb81562390fa70a37fa40b1305e\"\u003e\u003ccode\u003e71cf226\u003c/code\u003e\u003c/a\u003e v6-beta (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2298\"\u003e#2298\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/069c6959146423d11cd0184e6accf28f9d45f06e\"\u003e\u003ccode\u003e069c695\u003c/code\u003e\u003c/a\u003e Persist creds to a separate file (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2286\"\u003e#2286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493\"\u003e\u003ccode\u003eff7abcd\u003c/code\u003e\u003c/a\u003e Update README to include Node.js 24 support details and requirements (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2248\"\u003e#2248\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/08c6903cd8c0fde910a37f88322edcfb5dd907a8\"\u003e\u003ccode\u003e08c6903\u003c/code\u003e\u003c/a\u003e Prepare v5.0.0 release (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2238\"\u003e#2238\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/checkout/compare/v3.1.0...de0fac2e4500dabe0009e67214ff5f5447ce83dd\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `step-security/harden-runner` from 2.19.0 to 2.19.4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/step-security/harden-runner/releases\"\u003estep-security/harden-runner's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.19.4\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImprovements for HTTPS Monitoring for the Enterprise tier of Harden Runner\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.3...v2.19.4\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.3...v2.19.4\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.3\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDefault to audit mode when api-key missing with use-policy-store by \u003ca href=\"https://github.com/varunsh-coder\"\u003e\u003ccode\u003e@​varunsh-coder\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/665\"\u003estep-security/harden-runner#665\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: detect ubuntu-slim runners early and bail out by \u003ca href=\"https://github.com/devantler\"\u003e\u003ccode\u003e@​devantler\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/657\"\u003estep-security/harden-runner#657\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eWhat the fix changes\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eHarden-Runner will detect \u003ccode\u003eubuntu-slim\u003c/code\u003e runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eWhat the fix does not do\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eJobs running on \u003ccode\u003eubuntu-slim\u003c/code\u003e will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).\u003c/li\u003e\n\u003cli\u003ePer GitHub's docs on \u003ca href=\"https://docs.github.com/en/actions/reference/runners/github-hosted-runners#single-cpu-runners\"\u003esingle-CPU runners\u003c/a\u003e: \u0026quot;The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported.\u0026quot;  Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eFor StepSecurity enterprise customers\nIf your security posture requires that workflows are always monitored, you can block the use of \u003ccode\u003eubuntu-slim\u003c/code\u003e via workflow run policies see the \u003ca href=\"https://docs.stepsecurity.io/workflow-run-policies/policies#runner-label-policy\"\u003eRunner Label Policy\u003c/a\u003e docs. This lets you enforce that jobs only run on monitored runner types.\u003c/p\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/devantler\"\u003e\u003ccode\u003e@​devantler\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/657\"\u003estep-security/harden-runner#657\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/9af89fc71515a100421586dfdb3dc9c984fbf411\"\u003e\u003ccode\u003e9af89fc\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/667\"\u003e#667\u003c/a\u003e from step-security/update-agent-v1.8.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/485dce8cb5d75cda51e8bfa947de06030d080208\"\u003e\u003ccode\u003e485dce8\u003c/code\u003e\u003c/a\u003e Update agent to v1.8.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ab7a9404c0f3da075243ca237b5fac12c98deaa5\"\u003e\u003ccode\u003eab7a940\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/665\"\u003e#665\u003c/a\u003e from step-security/fix/use-policy-store-default-audit\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ec41b783c27ed7f0db6855a6d9970abd4572858c\"\u003e\u003ccode\u003eec41b78\u003c/code\u003e\u003c/a\u003e Default to audit mode when api-key missing with use-policy-store\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/9ca718d3bf646d6534007c269a635b3e54cadf99\"\u003e\u003ccode\u003e9ca718d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/664\"\u003e#664\u003c/a\u003e from step-security/update-agent-v1.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/1dee3df8d29f4225c582eee2ddb6053ca616c0df\"\u003e\u003ccode\u003e1dee3df\u003c/code\u003e\u003c/a\u003e Update agent to v1.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/a5ad31d6a139d249332a2605b85202e8c0b78450\"\u003e\u003ccode\u003ea5ad31d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/657\"\u003e#657\u003c/a\u003e from devantler/fix/ubuntu-slim-user-env\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/6e928567d74554b8842dd434908da31c593ba85c\"\u003e\u003ccode\u003e6e92856\u003c/code\u003e\u003c/a\u003e build dist and trim ubuntu-slim message\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/4e0504ee086374bdec7064e5c26d48af41ba6209\"\u003e\u003ccode\u003e4e0504e\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into fix/ubuntu-slim-user-env\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/376d25a97f3a1640ff8cbbddaa4af25948df2cf3\"\u003e\u003ccode\u003e376d25a\u003c/code\u003e\u003c/a\u003e fix: detect ubuntu-slim runners early and bail out\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/step-security/harden-runner/compare/8d3c67de8e2fe68ef647c8db1e6a09f647780f40...9af89fc71515a100421586dfdb3dc9c984fbf411\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `golangci/golangci-lint-action` from 9.2.0 to 9.2.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/golangci/golangci-lint-action/releases\"\u003egolangci/golangci-lint-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev9.2.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eIMPORTANT: this is the first immutable release.\u003c/p\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003echore: improve workflows by \u003ca href=\"https://github.com/ldez\"\u003e\u003ccode\u003e@​ldez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1394\"\u003egolangci/golangci-lint-action#1394\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependencies\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1325\"\u003egolangci/golangci-lint-action#1325\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1326\"\u003egolangci/golangci-lint-action#1326\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump the dependencies group with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1327\"\u003egolangci/golangci-lint-action#1327\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1328\"\u003egolangci/golangci-lint-action#1328\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 25.0.2 to 25.0.3 in the dependencies group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1329\"\u003egolangci/golangci-lint-action#1329\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1330\"\u003egolangci/golangci-lint-action#1330\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1332\"\u003egolangci/golangci-lint-action#1332\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1333\"\u003egolangci/golangci-lint-action#1333\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump the dependencies group with 6 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1334\"\u003egolangci/golangci-lint-action#1334\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1335\"\u003egolangci/golangci-lint-action#1335\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump the dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1336\"\u003egolangci/golangci-lint-action#1336\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1337\"\u003egolangci/golangci-lint-action#1337\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 25.0.9 to 25.0.10 in the dependencies group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1338\"\u003egolangci/golangci-lint-action#1338\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.3.3 to 5.3.4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1339\"\u003egolangci/golangci-lint-action#1339\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1340\"\u003egolangci/golangci-lint-action#1340\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1344\"\u003egolangci/golangci-lint-action#1344\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.3.4 to 5.3.6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1346\"\u003egolangci/golangci-lint-action#1346\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump minimatch by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1348\"\u003egolangci/golangci-lint-action#1348\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump minimatch from 3.1.3 to 3.1.5 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1350\"\u003egolangci/golangci-lint-action#1350\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.3.6 to 5.4.1 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1351\"\u003egolangci/golangci-lint-action#1351\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.4.1 to 5.5.6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1357\"\u003egolangci/golangci-lint-action#1357\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.5.6 to 5.5.7 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1358\"\u003egolangci/golangci-lint-action#1358\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump flatted from 3.3.3 to 3.4.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1359\"\u003egolangci/golangci-lint-action#1359\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump picomatch from 4.0.3 to 4.0.4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1364\"\u003egolangci/golangci-lint-action#1364\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump yaml from 2.8.2 to 2.8.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1365\"\u003egolangci/golangci-lint-action#1365\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump brace-expansion by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1370\"\u003egolangci/golangci-lint-action#1370\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates by \u003ca href=\"https://github.com/ldez\"\u003e\u003ccode\u003e@​ldez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1374\"\u003egolangci/golangci-lint-action#1374\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 4 to 4.35.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1384\"\u003egolangci/golangci-lint-action#1384\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-builder from 1.1.5 to 1.2.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1386\"\u003egolangci/golangci-lint-action#1386\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1389\"\u003egolangci/golangci-lint-action#1389\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1391\"\u003egolangci/golangci-lint-action#1391\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/golangci/golangci-lint-action/compare/v9.2.0...v9.2.1\"\u003ehttps://github.com/golangci/golangci-lint-action/compare/v9.2.0...v9.2.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/82606bf257cbaff209d206a39f5134f0cfbfd2ee\"\u003e\u003ccode\u003e82606bf\u003c/code\u003e\u003c/a\u003e chore: prepare release v9.2.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/97c8387e660fa3be78f698fb592523e1f906a02c\"\u003e\u003ccode\u003e97c8387\u003c/code\u003e\u003c/a\u003e chore: improve workflows (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1394\"\u003e#1394\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/28d0a191bb76f633872d1f12600dd9900ac73840\"\u003e\u003ccode\u003e28d0a19\u003c/code\u003e\u003c/a\u003e build(deps): bump the dependencies group across 1 directory with 2 updates\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/633fbc7d54a1fe7d54f72fb83194a7d442beb929\"\u003e\u003ccode\u003e633fbc7\u003c/code\u003e\u003c/a\u003e build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1391\"\u003e#1391\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/59f43e26c902dadac745307f8cf2537da50ad344\"\u003e\u003ccode\u003e59f43e2\u003c/code\u003e\u003c/a\u003e build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1389\"\u003e#1389\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/9eb174e04acac69b4b7f6602f9a5cc384ba59b45\"\u003e\u003ccode\u003e9eb174e\u003c/code\u003e\u003c/a\u003e build(deps): bump fast-xml-builder from 1.1.5 to 1.2.0 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1386\"\u003e#1386\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/4f52504dfb47d09a983372e869f643e9e0d4014b\"\u003e\u003ccode\u003e4f52504\u003c/code\u003e\u003c/a\u003e build(deps): bump github/codeql-action from 4 to 4.35.2 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1384\"\u003e#1384\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/6f87dfdbd16618b59a5d86104adea6216152a47c\"\u003e\u003ccode\u003e6f87dfd\u003c/code\u003e\u003c/a\u003e docs: update examples\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/c9500d7aa7797b3e999034a3e6a0b9a4f18e8708\"\u003e\u003ccode\u003ec9500d7\u003c/code\u003e\u003c/a\u003e chore: improve workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/03b1faa37ed78712fa70fc44b56fa553f0d7a6bc\"\u003e\u003ccode\u003e03b1faa\u003c/code\u003e\u003c/a\u003e chore: improve issue templates\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/golangci/golangci-lint-action/compare/1e7e51e771db61008b38414a730f564565cf7c20...82606bf257cbaff209d206a39f5134f0cfbfd2ee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `codecov/codecov-action` from 6.0.0 to 6.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/codecov/codecov-action/releases\"\u003ecodecov/codecov-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: prevent template injection in run: steps (VULN-1652) by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1947\"\u003ecodecov/codecov-action#1947\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(release): 6.0.1 by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1949\"\u003ecodecov/codecov-action#1949\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1\"\u003ehttps://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md\"\u003ecodecov/codecov-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.5.2\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.1\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: overwrite pr number on fork by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1871\"\u003ecodecov/codecov-action#1871\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump actions/checkout from 4.2.2 to 5.0.0 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1868\"\u003ecodecov/codecov-action#1868\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1867\"\u003ecodecov/codecov-action#1867\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update to use local app/ dir by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1872\"\u003ecodecov/codecov-action#1872\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: fix typo in README by \u003ca href=\"https://github.com/datalater\"\u003e\u003ccode\u003e@​datalater\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1866\"\u003ecodecov/codecov-action#1866\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument a \u003ccode\u003ecodecov-cli\u003c/code\u003e version reference example by \u003ca href=\"https://github.com/webknjaz\"\u003e\u003ccode\u003e@​webknjaz\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1774\"\u003ecodecov/codecov-action#1774\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1861\"\u003ecodecov/codecov-action#1861\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1833\"\u003ecodecov/codecov-action#1833\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.0\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efeat: upgrade wrapper to 0.2.4 by \u003ca href=\"https://github.com/jviall\"\u003e\u003ccode\u003e@​jviall\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1864\"\u003ecodecov/codecov-action#1864\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin actions/github-script by Git SHA by \u003ca href=\"https://github.com/martincostello\"\u003e\u003ccode\u003e@​martincostello\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1859\"\u003ecodecov/codecov-action#1859\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: check reqs exist by \u003ca href=\"https://github.com/joseph-sentry\"\u003e\u003ccode\u003e@​joseph-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1835\"\u003ecodecov/codecov-action#1835\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: Typo in README by \u003ca href=\"https://github.com/spalmurray\"\u003e\u003ccode\u003e@​spalmurray\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1838\"\u003ecodecov/codecov-action#1838\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: Refine OIDC docs by \u003ca href=\"https://github.com/spalmurray\"\u003e\u003ccode\u003e@​spalmurray\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1837\"\u003ecodecov/codecov-action#1837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1829\"\u003ecodecov/codecov-action#1829\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.3\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1822\"\u003ecodecov/codecov-action#1822\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: OIDC on forks by \u003ca href=\"https://github.com/joseph-sentry\"\u003e\u003ccode\u003e@​joseph-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1823\"\u003ecodecov/codecov-action#1823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/codecov/codecov-action/commit/e79a6962e0d4c0c17b229090214935d2e33f8354\"\u003e\u003ccode\u003ee79a696\u003c/code\u003e\u003c/a\u003e chore(release): 6.0.1 (\u003ca href=\"https://redirect.github.com/codecov/codecov-action/issues/1949\"\u003e#1949\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/codecov/codecov-action/commit/51e64229ac331acb0d7f7b17c67423995f991c79\"\u003e\u003ccode\u003e51e6422\u003c/code\u003e\u003c/a\u003e fix: prevent template injection in run: steps (VULN-1652) (\u003ca href=\"https://redirect.github.com/codecov/codecov-action/issues/1947\"\u003e#1947\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/codecov/codecov-action/compare/57e3a136b779b570ffcdbf80b3bdc90e7fab3de2...e79a6962e0d4c0c17b229090214935d2e33f8354\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action` from 2.1.36 to 4.36.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.36.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.19.4. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal \u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will be enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for GitHub-internal use only, and may change without notice at any time. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning analysis for a PR with \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP OIDC are now accepted. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBest-effort connection tests for private registries now use \u003ccode\u003eGET\u003c/code\u003e requests instead of \u003ccode\u003eHEAD\u003c/code\u003e for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3853\"\u003e#3853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3\"\u003e2.25.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3865\"\u003e#3865\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe undocumented TRAP cache cleanup feature that could be enabled using the \u003ccode\u003eCODEQL_ACTION_CLEANUP_TRAP_CACHES\u003c/code\u003e environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the \u003ccode\u003etrap-caching: false\u003c/code\u003e input to the \u003ccode\u003einit\u003c/code\u003e Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3795\"\u003e#3795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3789\"\u003e#3789\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePython analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3794\"\u003e#3794\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3807\"\u003e#3807\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2\"\u003e2.25.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3823\"\u003e#3823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix incorrect minimum required Git version for \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e: it should have been 2.36.0, not 2.11.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3781\"\u003e#3781\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReduced the minimum Git version required for \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e from 2.38.0 to 2.11.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3767\"\u003e#3767\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1\"\u003e2.25.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3773\"\u003e#3773\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.34.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDowngrade default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3\"\u003e2.24.3\u003c/a\u003e due to issues with a small percentage of Actions and JavaScript analyses. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3762\"\u003e#3762\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.34.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded an experimental change which disables TRAP caching when \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3569\"\u003e#3569\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eWe are rolling out improved incremental analysis to C/C++ analyses that use build mode \u003ccode\u003enone\u003c/code\u003e. We expect this rollout to be complete by the end of April 2026. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3584\"\u003e#3584\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0\"\u003e2.25.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3585\"\u003e#3585\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.33.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3562\"\u003e#3562\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eTo opt out of this change:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eRepositories owned by an organization:\u003c/strong\u003e Create a custom repository property with the name \u003ccode\u003egithub-codeql-file-coverage-on-prs\u003c/code\u003e and the type \u0026quot;True/false\u0026quot;, then set this property to \u003ccode\u003etrue\u003c/code\u003e in the repository's settings. For more information, see \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003eManaging custom properties for repositories in your organization\u003c/a\u003e. Alternatively, if you are using an advanced setup workflow, you can set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUser-owned repositories using default setup:\u003c/strong\u003e Switch to an advanced setup workflow and set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUser-owned repositories using advanced setup:\u003c/strong\u003e Set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7211b7c8077ea37d8641b6271f6a365a22a5fbfa\"\u003e\u003ccode\u003e7211b7c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3927\"\u003e#3927\u003c/a\u003e from github/update-v4.36.0-ebc2d9e2b\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7740f2fb21add1d46278215acea47540db22f022\"\u003e\u003ccode\u003e7740f2f\u003c/code\u003e\u003c/a\u003e Update changelog for v4.36.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ebc2d9e2bc247eec51bee8d4df806c4030eb0761\"\u003e\u003ccode\u003eebc2d9e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3926\"\u003e#3926\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.25.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d1f74b777c95c777bf4f42ce4b250bc916e745c7\"\u003e\u003ccode\u003ed1f74b7\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/2dc40cec39bdc63d3561d74fa6100cebb0418ff4\"\u003e\u003ccode\u003e2dc40ce\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.25.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/84498526a009a99c875e83ef4821a8ba52de7c22\"\u003e\u003ccode\u003e8449852\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3910\"\u003e#3910\u003c/a\u003e from github/henrymercer/repo-size-diff-check\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/72ac23c6d16b29fbe801e87e3439941558c53094\"\u003e\u003ccode\u003e72ac23c\u003c/code\u003e\u003c/a\u003e Update excluded required check list\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c5297a28a2c3e6a8062041b58858bd7117cebe37\"\u003e\u003ccode\u003ec5297a2\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3919\"\u003e#3919\u003c/a\u003e from github/henrymercer/workflow-concurrency\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8ffeae7d05bc1b914a009d197e64e4f5c9e14503\"\u003e\u003ccode\u003e8ffeae7\u003c/code\u003e\u003c/a\u003e CI: Automatically cancel non-generated workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/f3f52bf568dc44a1069faafa538caa6b1fec40c9\"\u003e\u003ccode\u003ef3f52bf\u003c/code\u003e\u003c/a\u003e Revert \u003ccode\u003egetErrorMessage\u003c/code\u003e import\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/v2.1.36...v4.36.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/dependency-review-action` from 4.9.0 to 5.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/dependency-review-action/releases\"\u003eactions/dependency-review-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e5.0.0\u003c/h2\u003e\n\u003cp\u003eThis is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version \u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003ev2.327.1\u003c/a\u003e to run.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd .github/copilot-instructions.md for Copilot coding agent by \u003ca href=\"https://github.com/ahpook\"\u003e\u003ccode\u003e@​ahpook\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1067\"\u003eactions/dependency-review-action#1067\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate Node.js runtime from 20 to 24 by \u003ca href=\"https://github.com/scottschreckengaust\"\u003e\u003ccode\u003e@​scottschreckengaust\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1084\"\u003eactions/dependency-review-action#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump spdx-license-ids from 3.0.20 to 3.0.23 by \u003ca href=\"https://github.com/mongolyy\"\u003e\u003ccode\u003e@​mongolyy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1091\"\u003eactions/dependency-review-action#1091\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: bump actions/checkout from v4 to v6 in workflow examples by \u003ca href=\"https://github.com/Marukome0743\"\u003e\u003ccode\u003e@​Marukome0743\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1077\"\u003eactions/dependency-review-action#1077\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: patched version display for advisories with non-strict semver ranges (e.g. Maven beta versions) by \u003ca href=\"https://github.com/tspascoal\"\u003e\u003ccode\u003e@​tspascoal\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1076\"\u003eactions/dependency-review-action#1076\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolve security findings by \u003ca href=\"https://github.com/AshelyTC\"\u003e\u003ccode\u003e@​AshelyTC\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1094\"\u003eactions/dependency-review-action#1094\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ev5.0.0 release branch by \u003ca href=\"https://github.com/ahpook\"\u003e\u003ccode\u003e@​ahpook\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1098\"\u003eactions/dependency-review-action#1098\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scottschreckengaust\"\u003e\u003ccode\u003e@​scottschreckengaust\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1084\"\u003eactions/dependency-review-action#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mongolyy\"\u003e\u003ccode\u003e@​mongolyy\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1091\"\u003eactions/dependency-review-action#1091\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Marukome0743\"\u003e\u003ccode\u003e@​Marukome0743\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1077\"\u003eactions/dependency-review-action#1077\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/dependency-review-action/compare/v4.9.0...v5.0.0\"\u003ehttps://github.com/actions/dependency-review-action/compare/v4.9.0...v5.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/a1d282b36b6f3519aa1f3fc636f609c47dddb294\"\u003e\u003ccode\u003ea1d282b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1098\"\u003e#1098\u003c/a\u003e from actions/ahpook/v5-release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/eb6c199c5a85c7387f1f0b02b3ba5c6364740695\"\u003e\u003ccode\u003eeb6c199\u003c/code\u003e\u003c/a\u003e update examples to show \u003ca href=\"https://github.com/v5\"\u003e\u003ccode\u003e@​v5\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/3943c2c5beaaaf1806eb3758273c203dabcbf89c\"\u003e\u003ccode\u003e3943c2c\u003c/code\u003e\u003c/a\u003e v5.0.0 release branch\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/454943c880b147adbfe7de0cdd3ece1c00882033\"\u003e\u003ccode\u003e454943c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1094\"\u003e#1094\u003c/a\u003e from actions/ashelytc/security-findings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/6d92a1228e9e9db334f02c09f84fe9217d2b4463\"\u003e\u003ccode\u003e6d92a12\u003c/code\u003e\u003c/a\u003e revert \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e update\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/a8e5a7e93695b41abf6d1083cd220bee39a720f0\"\u003e\u003ccode\u003ea8e5a7e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1076\"\u003e#1076\u003c/a\u003e from tspascoal/fix-version-matching-for-non-string-s...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/b6b7079031ef4ed61656c221988f1f3bcbf35101\"\u003e\u003ccode\u003eb6b7079\u003c/code\u003e\u003c/a\u003e update \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e to 8.40.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/821a21dd691f162c4c5c2e9754a344accde9a208\"\u003e\u003ccode\u003e821a21d\u003c/code\u003e\u003c/a\u003e update more dependencies\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/05aaaae45cf4c420de012addf2a72e3435ddaa63\"\u003e\u003ccode\u003e05aaaae\u003c/code\u003e\u003c/a\u003e run npm audit fix\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/55d3e754501fc13c84b95637ce51f135012d41ea\"\u003e\u003ccode\u003e55d3e75\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1077\"\u003e#1077\u003c/a\u003e from Marukome0743/docs/checkout\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/dependency-review-action/compare/2031cfc080254a8a887f58cffee85186f0e49e48...a1d282b36b6f3519aa1f3fc636f609c47dddb294\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `goreleaser/goreleaser-action` from 7.2.1 to 7.2.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/goreleaser/goreleaser-action/releases\"\u003egoreleaser/goreleaser-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.2.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eci(deps): bump the actions group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/560\"\u003egoreleaser/goreleaser-action#560\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: nightly resolution to select newest published release by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/562\"\u003egoreleaser/goreleaser-action#562\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/562\"\u003egoreleaser/goreleaser-action#562\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/v7...v7.2.2\"\u003ehttps://github.com/goreleaser/goreleaser-action/compare/v7...v7.2.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89\"\u003e\u003ccode\u003e5daf1e9\u003c/code\u003e\u003c/a\u003e fix: nightly resolution to select newest published release (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/562\"\u003e#562\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/5cc7ebb73d78b8f1d7b03c568e7df999c2889ccf\"\u003e\u003ccode\u003e5cc7ebb\u003c/code\u003e\u003c/a\u003e ci: update actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/702f5f91c9334614254ddeabeebaf820d707f0d6\"\u003e\u003ccode\u003e702f5f9\u003c/code\u003e\u003c/a\u003e ci(deps): bump the actions group with 3 updates (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/560\"\u003e#560\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8...5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/labeler` from 6.0.1 to 6.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/labeler/releases\"\u003eactions/labeler's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.1.0\u003c/h2\u003e\n\u003ch2\u003eEnhancements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd changed-files-labels-limit and max-files-changed configuration options to cap the number of labels added by \u003ca href=\"https://github.com/bluca\"\u003e\u003ccode\u003e@​bluca\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/923\"\u003eactions/labeler#923\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImprove Labeler Action documentation and permission error handling by \u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/897\"\u003eactions/labeler#897\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePreserve manually added labels during workflow runs and refine label synchronization logic by \u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/917\"\u003eactions/labeler#917\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDependency Updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/877\"\u003eactions/labeler#877\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade minimatch from 10.0.1 to 10.2.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/926\"\u003eactions/labeler#926\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade dependencies (\u003ccode\u003e@​actions/core\u003c/code\u003e, \u003ccode\u003e@​actions/github\u003c/code\u003e, js-yaml, minimatch, \u003ca href=\"https://github.com/typescript-eslint\"\u003e\u003ccode\u003e@​typescript-eslint\u003c/code\u003e\u003c/a\u003e) by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/934\"\u003eactions/labeler#934\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/897\"\u003eactions/labeler#897\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/bluca\"\u003e\u003ccode\u003e@​bluca\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/923\"\u003eactions/labeler#923\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/934\"\u003eactions/labeler#934\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/labeler/compare/v6...v6.1.0\"\u003ehttps://github.com/actions/labeler/compare/v6...v6.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/f27b608878404679385c85cfa523b85ccb86e213\"\u003e\u003ccode\u003ef27b608\u003c/code\u003e\u003c/a\u003e chore: upgrade dependencies (\u003ccode\u003e@​actions/core\u003c/code\u003e, \u003ccode\u003e@​actions/github\u003c/code\u003e, js-yaml, minimat...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/c5dadc2a45784a4b6adfcd20fea3465da3a5f904\"\u003e\u003ccode\u003ec5dadc2\u003c/code\u003e\u003c/a\u003e Add 'changed-files-labels-limit' and 'max-files-changed' configs to allow cap...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/e52e4fb63ed5cd0e07abaad9826b2a893ccb921f\"\u003e\u003ccode\u003ee52e4fb\u003c/code\u003e\u003c/a\u003e Bump minimatch from 10.0.1 to 10.2.3 (\u003ca href=\"https://redirect.github.com/actions/labeler/issues/926\"\u003e#926\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/77a4082b841706ac431479b7e2bb11216ffef250\"\u003e\u003ccode\u003e77a4082\u003c/code\u003e\u003c/a\u003e Fix: Preserve manually added labels during workflow run and refine label sync...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/25abb3cad4f14b7ac27968a495c37798860a5a1a\"\u003e\u003ccode\u003e25abb3c\u003c/code\u003e\u003c/a\u003e Improve Labeler Action Documentation and Error Handling for Permissions (\u003ca href=\"https://redirect.github.com/actions/labeler/issues/897\"\u003e#897\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/395c8cfdb1e1e691cc4bad0dd315820af8eb67fd\"\u003e\u003ccode\u003e395c8cf\u003c/code\u003e\u003c/a\u003e Bump brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v...\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/labeler/compare/634933edcd8ababfe52f92936142cc22ac488b1b...f27b608878404679385c85cfa523b85ccb86e213\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action` from 2.3.5 to 2.3.8\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9...\n\n_Description has been truncated_","html_url":"https://github.com/actions-marketplace-validations/afadesigns_zshellcheck/pull/3","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions-marketplace-validations%2Fafadesigns_zshellcheck/issues/3","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/3/packages"}},{"old_version":"2.3.5","new_version":"2.3.8","update_type":"patch","path":null,"pr_created_at":"2026-05-27T08:54:55.000Z","version_change":"2.3.5 → 2.3.8","issue":{"uuid":"4530981084","node_id":"PR_kwDOQUkg5c7fwAdQ","number":1335,"state":"open","title":"chore(deps): bump the github-actions group across 1 directory with 12 updates","user":"dependabot[bot]","labels":["deps","ci"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-05-27T08:54:55.000Z","updated_at":"2026-05-31T01:42:27.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"github-actions","update_count":12,"packages":[{"name":"step-security/harden-runner","old_version":"2.19.0","new_version":"2.19.4","repository_url":"https://github.com/step-security/harden-runner"},{"name":"golangci/golangci-lint-action","old_version":"9.2.0","new_version":"9.2.1","repository_url":"https://github.com/golangci/golangci-lint-action"},{"name":"codecov/codecov-action","old_version":"6.0.0","new_version":"6.0.1","repository_url":"https://github.com/codecov/codecov-action"},{"name":"actions/dependency-review-action","old_version":"4.9.0","new_version":"5.0.0","repository_url":"https://github.com/actions/dependency-review-action"},{"name":"goreleaser/goreleaser-action","old_version":"7.2.1","new_version":"7.2.2","repository_url":"https://github.com/goreleaser/goreleaser-action"},{"name":"actions/labeler","old_version":"6.0.1","new_version":"6.1.0","repository_url":"https://github.com/actions/labeler"},{"name":"google/osv-scanner-action","old_version":"2.3.5","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"release-drafter/release-drafter","old_version":"7.2.1","new_version":"7.3.1","repository_url":"https://github.com/release-drafter/release-drafter"},{"name":"sigstore/cosign-installer","old_version":"4.1.1","new_version":"4.1.2","repository_url":"https://github.com/sigstore/cosign-installer"},{"name":"docker/setup-buildx-action","old_version":"4.0.0","new_version":"4.1.0","repository_url":"https://github.com/docker/setup-buildx-action"},{"name":"docker/login-action","old_version":"4.1.0","new_version":"4.2.0","repository_url":"https://github.com/docker/login-action"},{"name":"crate-ci/typos","old_version":"1.45.2","new_version":"1.46.3","repository_url":"https://github.com/crate-ci/typos"}],"path":null,"ecosystem":"actions"},"body":"[//]: # (dependabot-start)\n⚠️  **Dependabot is rebasing this PR** ⚠️ \n\nRebasing might not happen immediately, so don't worry if this takes some time.\n\nNote: if you make any changes to this PR yourself, they will take precedence over the rebase.\n\n---\n\n[//]: # (dependabot-end)\n\nBumps the github-actions group with 12 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.19.0` | `2.19.4` |\n| [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `9.2.0` | `9.2.1` |\n| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `6.0.0` | `6.0.1` |\n| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.9.0` | `5.0.0` |\n| [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `7.2.1` | `7.2.2` |\n| [actions/labeler](https://github.com/actions/labeler) | `6.0.1` | `6.1.0` |\n| [google/osv-scanner-action](https://github.com/google/osv-scanner-action) | `2.3.5` | `2.3.8` |\n| [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) | `7.2.1` | `7.3.1` |\n| [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `4.1.1` | `4.1.2` |\n| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.0.0` | `4.1.0` |\n| [docker/login-action](https://github.com/docker/login-action) | `4.1.0` | `4.2.0` |\n| [crate-ci/typos](https://github.com/crate-ci/typos) | `1.45.2` | `1.46.3` |\n\n\nUpdates `step-security/harden-runner` from 2.19.0 to 2.19.4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/step-security/harden-runner/releases\"\u003estep-security/harden-runner's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.19.4\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImprovements for HTTPS Monitoring for the Enterprise tier of Harden Runner\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.3...v2.19.4\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.3...v2.19.4\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.3\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDefault to audit mode when api-key missing with use-policy-store by \u003ca href=\"https://github.com/varunsh-coder\"\u003e\u003ccode\u003e@​varunsh-coder\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/665\"\u003estep-security/harden-runner#665\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: detect ubuntu-slim runners early and bail out by \u003ca href=\"https://github.com/devantler\"\u003e\u003ccode\u003e@​devantler\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/657\"\u003estep-security/harden-runner#657\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eWhat the fix changes\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eHarden-Runner will detect \u003ccode\u003eubuntu-slim\u003c/code\u003e runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eWhat the fix does not do\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eJobs running on \u003ccode\u003eubuntu-slim\u003c/code\u003e will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).\u003c/li\u003e\n\u003cli\u003ePer GitHub's docs on \u003ca href=\"https://docs.github.com/en/actions/reference/runners/github-hosted-runners#single-cpu-runners\"\u003esingle-CPU runners\u003c/a\u003e: \u0026quot;The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported.\u0026quot;  Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eFor StepSecurity enterprise customers\nIf your security posture requires that workflows are always monitored, you can block the use of \u003ccode\u003eubuntu-slim\u003c/code\u003e via workflow run policies see the \u003ca href=\"https://docs.stepsecurity.io/workflow-run-policies/policies#runner-label-policy\"\u003eRunner Label Policy\u003c/a\u003e docs. This lets you enforce that jobs only run on monitored runner types.\u003c/p\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/devantler\"\u003e\u003ccode\u003e@​devantler\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/657\"\u003estep-security/harden-runner#657\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/9af89fc71515a100421586dfdb3dc9c984fbf411\"\u003e\u003ccode\u003e9af89fc\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/667\"\u003e#667\u003c/a\u003e from step-security/update-agent-v1.8.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/485dce8cb5d75cda51e8bfa947de06030d080208\"\u003e\u003ccode\u003e485dce8\u003c/code\u003e\u003c/a\u003e Update agent to v1.8.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ab7a9404c0f3da075243ca237b5fac12c98deaa5\"\u003e\u003ccode\u003eab7a940\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/665\"\u003e#665\u003c/a\u003e from step-security/fix/use-policy-store-default-audit\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ec41b783c27ed7f0db6855a6d9970abd4572858c\"\u003e\u003ccode\u003eec41b78\u003c/code\u003e\u003c/a\u003e Default to audit mode when api-key missing with use-policy-store\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/9ca718d3bf646d6534007c269a635b3e54cadf99\"\u003e\u003ccode\u003e9ca718d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/664\"\u003e#664\u003c/a\u003e from step-security/update-agent-v1.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/1dee3df8d29f4225c582eee2ddb6053ca616c0df\"\u003e\u003ccode\u003e1dee3df\u003c/code\u003e\u003c/a\u003e Update agent to v1.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/a5ad31d6a139d249332a2605b85202e8c0b78450\"\u003e\u003ccode\u003ea5ad31d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/657\"\u003e#657\u003c/a\u003e from devantler/fix/ubuntu-slim-user-env\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/6e928567d74554b8842dd434908da31c593ba85c\"\u003e\u003ccode\u003e6e92856\u003c/code\u003e\u003c/a\u003e build dist and trim ubuntu-slim message\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/4e0504ee086374bdec7064e5c26d48af41ba6209\"\u003e\u003ccode\u003e4e0504e\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into fix/ubuntu-slim-user-env\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/376d25a97f3a1640ff8cbbddaa4af25948df2cf3\"\u003e\u003ccode\u003e376d25a\u003c/code\u003e\u003c/a\u003e fix: detect ubuntu-slim runners early and bail out\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/step-security/harden-runner/compare/8d3c67de8e2fe68ef647c8db1e6a09f647780f40...9af89fc71515a100421586dfdb3dc9c984fbf411\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `golangci/golangci-lint-action` from 9.2.0 to 9.2.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/golangci/golangci-lint-action/releases\"\u003egolangci/golangci-lint-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev9.2.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eIMPORTANT: this is the first immutable release.\u003c/p\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003echore: improve workflows by \u003ca href=\"https://github.com/ldez\"\u003e\u003ccode\u003e@​ldez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1394\"\u003egolangci/golangci-lint-action#1394\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependencies\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1325\"\u003egolangci/golangci-lint-action#1325\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1326\"\u003egolangci/golangci-lint-action#1326\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump the dependencies group with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1327\"\u003egolangci/golangci-lint-action#1327\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1328\"\u003egolangci/golangci-lint-action#1328\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 25.0.2 to 25.0.3 in the dependencies group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1329\"\u003egolangci/golangci-lint-action#1329\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1330\"\u003egolangci/golangci-lint-action#1330\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1332\"\u003egolangci/golangci-lint-action#1332\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1333\"\u003egolangci/golangci-lint-action#1333\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump the dependencies group with 6 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1334\"\u003egolangci/golangci-lint-action#1334\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1335\"\u003egolangci/golangci-lint-action#1335\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump the dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1336\"\u003egolangci/golangci-lint-action#1336\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1337\"\u003egolangci/golangci-lint-action#1337\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 25.0.9 to 25.0.10 in the dependencies group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1338\"\u003egolangci/golangci-lint-action#1338\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.3.3 to 5.3.4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1339\"\u003egolangci/golangci-lint-action#1339\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1340\"\u003egolangci/golangci-lint-action#1340\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1344\"\u003egolangci/golangci-lint-action#1344\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.3.4 to 5.3.6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1346\"\u003egolangci/golangci-lint-action#1346\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump minimatch by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1348\"\u003egolangci/golangci-lint-action#1348\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump minimatch from 3.1.3 to 3.1.5 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1350\"\u003egolangci/golangci-lint-action#1350\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.3.6 to 5.4.1 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1351\"\u003egolangci/golangci-lint-action#1351\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.4.1 to 5.5.6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1357\"\u003egolangci/golangci-lint-action#1357\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.5.6 to 5.5.7 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1358\"\u003egolangci/golangci-lint-action#1358\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump flatted from 3.3.3 to 3.4.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1359\"\u003egolangci/golangci-lint-action#1359\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump picomatch from 4.0.3 to 4.0.4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1364\"\u003egolangci/golangci-lint-action#1364\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump yaml from 2.8.2 to 2.8.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1365\"\u003egolangci/golangci-lint-action#1365\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump brace-expansion by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1370\"\u003egolangci/golangci-lint-action#1370\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates by \u003ca href=\"https://github.com/ldez\"\u003e\u003ccode\u003e@​ldez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1374\"\u003egolangci/golangci-lint-action#1374\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 4 to 4.35.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1384\"\u003egolangci/golangci-lint-action#1384\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-builder from 1.1.5 to 1.2.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1386\"\u003egolangci/golangci-lint-action#1386\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1389\"\u003egolangci/golangci-lint-action#1389\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1391\"\u003egolangci/golangci-lint-action#1391\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/golangci/golangci-lint-action/compare/v9.2.0...v9.2.1\"\u003ehttps://github.com/golangci/golangci-lint-action/compare/v9.2.0...v9.2.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/82606bf257cbaff209d206a39f5134f0cfbfd2ee\"\u003e\u003ccode\u003e82606bf\u003c/code\u003e\u003c/a\u003e chore: prepare release v9.2.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/97c8387e660fa3be78f698fb592523e1f906a02c\"\u003e\u003ccode\u003e97c8387\u003c/code\u003e\u003c/a\u003e chore: improve workflows (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1394\"\u003e#1394\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/28d0a191bb76f633872d1f12600dd9900ac73840\"\u003e\u003ccode\u003e28d0a19\u003c/code\u003e\u003c/a\u003e build(deps): bump the dependencies group across 1 directory with 2 updates\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/633fbc7d54a1fe7d54f72fb83194a7d442beb929\"\u003e\u003ccode\u003e633fbc7\u003c/code\u003e\u003c/a\u003e build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1391\"\u003e#1391\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/59f43e26c902dadac745307f8cf2537da50ad344\"\u003e\u003ccode\u003e59f43e2\u003c/code\u003e\u003c/a\u003e build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1389\"\u003e#1389\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/9eb174e04acac69b4b7f6602f9a5cc384ba59b45\"\u003e\u003ccode\u003e9eb174e\u003c/code\u003e\u003c/a\u003e build(deps): bump fast-xml-builder from 1.1.5 to 1.2.0 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1386\"\u003e#1386\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/4f52504dfb47d09a983372e869f643e9e0d4014b\"\u003e\u003ccode\u003e4f52504\u003c/code\u003e\u003c/a\u003e build(deps): bump github/codeql-action from 4 to 4.35.2 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1384\"\u003e#1384\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/6f87dfdbd16618b59a5d86104adea6216152a47c\"\u003e\u003ccode\u003e6f87dfd\u003c/code\u003e\u003c/a\u003e docs: update examples\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/c9500d7aa7797b3e999034a3e6a0b9a4f18e8708\"\u003e\u003ccode\u003ec9500d7\u003c/code\u003e\u003c/a\u003e chore: improve workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/03b1faa37ed78712fa70fc44b56fa553f0d7a6bc\"\u003e\u003ccode\u003e03b1faa\u003c/code\u003e\u003c/a\u003e chore: improve issue templates\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/golangci/golangci-lint-action/compare/1e7e51e771db61008b38414a730f564565cf7c20...82606bf257cbaff209d206a39f5134f0cfbfd2ee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `codecov/codecov-action` from 6.0.0 to 6.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/codecov/codecov-action/releases\"\u003ecodecov/codecov-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: prevent template injection in run: steps (VULN-1652) by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1947\"\u003ecodecov/codecov-action#1947\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(release): 6.0.1 by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1949\"\u003ecodecov/codecov-action#1949\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1\"\u003ehttps://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md\"\u003ecodecov/codecov-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.5.2\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.1\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: overwrite pr number on fork by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1871\"\u003ecodecov/codecov-action#1871\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump actions/checkout from 4.2.2 to 5.0.0 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1868\"\u003ecodecov/codecov-action#1868\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1867\"\u003ecodecov/codecov-action#1867\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update to use local app/ dir by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1872\"\u003ecodecov/codecov-action#1872\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: fix typo in README by \u003ca href=\"https://github.com/datalater\"\u003e\u003ccode\u003e@​datalater\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1866\"\u003ecodecov/codecov-action#1866\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument a \u003ccode\u003ecodecov-cli\u003c/code\u003e version reference example by \u003ca href=\"https://github.com/webknjaz\"\u003e\u003ccode\u003e@​webknjaz\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1774\"\u003ecodecov/codecov-action#1774\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1861\"\u003ecodecov/codecov-action#1861\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1833\"\u003ecodecov/codecov-action#1833\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.0\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efeat: upgrade wrapper to 0.2.4 by \u003ca href=\"https://github.com/jviall\"\u003e\u003ccode\u003e@​jviall\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1864\"\u003ecodecov/codecov-action#1864\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin actions/github-script by Git SHA by \u003ca href=\"https://github.com/martincostello\"\u003e\u003ccode\u003e@​martincostello\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1859\"\u003ecodecov/codecov-action#1859\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: check reqs exist by \u003ca href=\"https://github.com/joseph-sentry\"\u003e\u003ccode\u003e@​joseph-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1835\"\u003ecodecov/codecov-action#1835\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: Typo in README by \u003ca href=\"https://github.com/spalmurray\"\u003e\u003ccode\u003e@​spalmurray\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1838\"\u003ecodecov/codecov-action#1838\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: Refine OIDC docs by \u003ca href=\"https://github.com/spalmurray\"\u003e\u003ccode\u003e@​spalmurray\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1837\"\u003ecodecov/codecov-action#1837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1829\"\u003ecodecov/codecov-action#1829\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.3\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1822\"\u003ecodecov/codecov-action#1822\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: OIDC on forks by \u003ca href=\"https://github.com/joseph-sentry\"\u003e\u003ccode\u003e@​joseph-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1823\"\u003ecodecov/codecov-action#1823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/codecov/codecov-action/commit/e79a6962e0d4c0c17b229090214935d2e33f8354\"\u003e\u003ccode\u003ee79a696\u003c/code\u003e\u003c/a\u003e chore(release): 6.0.1 (\u003ca href=\"https://redirect.github.com/codecov/codecov-action/issues/1949\"\u003e#1949\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/codecov/codecov-action/commit/51e64229ac331acb0d7f7b17c67423995f991c79\"\u003e\u003ccode\u003e51e6422\u003c/code\u003e\u003c/a\u003e fix: prevent template injection in run: steps (VULN-1652) (\u003ca href=\"https://redirect.github.com/codecov/codecov-action/issues/1947\"\u003e#1947\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/codecov/codecov-action/compare/57e3a136b779b570ffcdbf80b3bdc90e7fab3de2...e79a6962e0d4c0c17b229090214935d2e33f8354\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/dependency-review-action` from 4.9.0 to 5.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/dependency-review-action/releases\"\u003eactions/dependency-review-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e5.0.0\u003c/h2\u003e\n\u003cp\u003eThis is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version \u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003ev2.327.1\u003c/a\u003e to run.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd .github/copilot-instructions.md for Copilot coding agent by \u003ca href=\"https://github.com/ahpook\"\u003e\u003ccode\u003e@​ahpook\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1067\"\u003eactions/dependency-review-action#1067\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate Node.js runtime from 20 to 24 by \u003ca href=\"https://github.com/scottschreckengaust\"\u003e\u003ccode\u003e@​scottschreckengaust\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1084\"\u003eactions/dependency-review-action#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump spdx-license-ids from 3.0.20 to 3.0.23 by \u003ca href=\"https://github.com/mongolyy\"\u003e\u003ccode\u003e@​mongolyy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1091\"\u003eactions/dependency-review-action#1091\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: bump actions/checkout from v4 to v6 in workflow examples by \u003ca href=\"https://github.com/Marukome0743\"\u003e\u003ccode\u003e@​Marukome0743\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1077\"\u003eactions/dependency-review-action#1077\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: patched version display for advisories with non-strict semver ranges (e.g. Maven beta versions) by \u003ca href=\"https://github.com/tspascoal\"\u003e\u003ccode\u003e@​tspascoal\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1076\"\u003eactions/dependency-review-action#1076\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolve security findings by \u003ca href=\"https://github.com/AshelyTC\"\u003e\u003ccode\u003e@​AshelyTC\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1094\"\u003eactions/dependency-review-action#1094\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ev5.0.0 release branch by \u003ca href=\"https://github.com/ahpook\"\u003e\u003ccode\u003e@​ahpook\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1098\"\u003eactions/dependency-review-action#1098\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scottschreckengaust\"\u003e\u003ccode\u003e@​scottschreckengaust\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1084\"\u003eactions/dependency-review-action#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mongolyy\"\u003e\u003ccode\u003e@​mongolyy\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1091\"\u003eactions/dependency-review-action#1091\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Marukome0743\"\u003e\u003ccode\u003e@​Marukome0743\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1077\"\u003eactions/dependency-review-action#1077\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/dependency-review-action/compare/v4.9.0...v5.0.0\"\u003ehttps://github.com/actions/dependency-review-action/compare/v4.9.0...v5.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/a1d282b36b6f3519aa1f3fc636f609c47dddb294\"\u003e\u003ccode\u003ea1d282b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1098\"\u003e#1098\u003c/a\u003e from actions/ahpook/v5-release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/eb6c199c5a85c7387f1f0b02b3ba5c6364740695\"\u003e\u003ccode\u003eeb6c199\u003c/code\u003e\u003c/a\u003e update examples to show \u003ca href=\"https://github.com/v5\"\u003e\u003ccode\u003e@​v5\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/3943c2c5beaaaf1806eb3758273c203dabcbf89c\"\u003e\u003ccode\u003e3943c2c\u003c/code\u003e\u003c/a\u003e v5.0.0 release branch\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/454943c880b147adbfe7de0cdd3ece1c00882033\"\u003e\u003ccode\u003e454943c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1094\"\u003e#1094\u003c/a\u003e from actions/ashelytc/security-findings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/6d92a1228e9e9db334f02c09f84fe9217d2b4463\"\u003e\u003ccode\u003e6d92a12\u003c/code\u003e\u003c/a\u003e revert \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e update\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/a8e5a7e93695b41abf6d1083cd220bee39a720f0\"\u003e\u003ccode\u003ea8e5a7e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1076\"\u003e#1076\u003c/a\u003e from tspascoal/fix-version-matching-for-non-string-s...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/b6b7079031ef4ed61656c221988f1f3bcbf35101\"\u003e\u003ccode\u003eb6b7079\u003c/code\u003e\u003c/a\u003e update \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e to 8.40.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/821a21dd691f162c4c5c2e9754a344accde9a208\"\u003e\u003ccode\u003e821a21d\u003c/code\u003e\u003c/a\u003e update more dependencies\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/05aaaae45cf4c420de012addf2a72e3435ddaa63\"\u003e\u003ccode\u003e05aaaae\u003c/code\u003e\u003c/a\u003e run npm audit fix\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/55d3e754501fc13c84b95637ce51f135012d41ea\"\u003e\u003ccode\u003e55d3e75\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1077\"\u003e#1077\u003c/a\u003e from Marukome0743/docs/checkout\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/dependency-review-action/compare/2031cfc080254a8a887f58cffee85186f0e49e48...a1d282b36b6f3519aa1f3fc636f609c47dddb294\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `goreleaser/goreleaser-action` from 7.2.1 to 7.2.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/goreleaser/goreleaser-action/releases\"\u003egoreleaser/goreleaser-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.2.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eci(deps): bump the actions group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/560\"\u003egoreleaser/goreleaser-action#560\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: nightly resolution to select newest published release by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/562\"\u003egoreleaser/goreleaser-action#562\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/562\"\u003egoreleaser/goreleaser-action#562\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/v7...v7.2.2\"\u003ehttps://github.com/goreleaser/goreleaser-action/compare/v7...v7.2.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89\"\u003e\u003ccode\u003e5daf1e9\u003c/code\u003e\u003c/a\u003e fix: nightly resolution to select newest published release (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/562\"\u003e#562\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/5cc7ebb73d78b8f1d7b03c568e7df999c2889ccf\"\u003e\u003ccode\u003e5cc7ebb\u003c/code\u003e\u003c/a\u003e ci: update actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/702f5f91c9334614254ddeabeebaf820d707f0d6\"\u003e\u003ccode\u003e702f5f9\u003c/code\u003e\u003c/a\u003e ci(deps): bump the actions group with 3 updates (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/560\"\u003e#560\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8...5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/labeler` from 6.0.1 to 6.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/labeler/releases\"\u003eactions/labeler's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.1.0\u003c/h2\u003e\n\u003ch2\u003eEnhancements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd changed-files-labels-limit and max-files-changed configuration options to cap the number of labels added by \u003ca href=\"https://github.com/bluca\"\u003e\u003ccode\u003e@​bluca\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/923\"\u003eactions/labeler#923\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImprove Labeler Action documentation and permission error handling by \u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/897\"\u003eactions/labeler#897\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePreserve manually added labels during workflow runs and refine label synchronization logic by \u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/917\"\u003eactions/labeler#917\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDependency Updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/877\"\u003eactions/labeler#877\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade minimatch from 10.0.1 to 10.2.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/926\"\u003eactions/labeler#926\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade dependencies (\u003ccode\u003e@​actions/core\u003c/code\u003e, \u003ccode\u003e@​actions/github\u003c/code\u003e, js-yaml, minimatch, \u003ca href=\"https://github.com/typescript-eslint\"\u003e\u003ccode\u003e@​typescript-eslint\u003c/code\u003e\u003c/a\u003e) by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/934\"\u003eactions/labeler#934\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/897\"\u003eactions/labeler#897\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/bluca\"\u003e\u003ccode\u003e@​bluca\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/923\"\u003eactions/labeler#923\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/934\"\u003eactions/labeler#934\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/labeler/compare/v6...v6.1.0\"\u003ehttps://github.com/actions/labeler/compare/v6...v6.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/f27b608878404679385c85cfa523b85ccb86e213\"\u003e\u003ccode\u003ef27b608\u003c/code\u003e\u003c/a\u003e chore: upgrade dependencies (\u003ccode\u003e@​actions/core\u003c/code\u003e, \u003ccode\u003e@​actions/github\u003c/code\u003e, js-yaml, minimat...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/c5dadc2a45784a4b6adfcd20fea3465da3a5f904\"\u003e\u003ccode\u003ec5dadc2\u003c/code\u003e\u003c/a\u003e Add 'changed-files-labels-limit' and 'max-files-changed' configs to allow cap...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/e52e4fb63ed5cd0e07abaad9826b2a893ccb921f\"\u003e\u003ccode\u003ee52e4fb\u003c/code\u003e\u003c/a\u003e Bump minimatch from 10.0.1 to 10.2.3 (\u003ca href=\"https://redirect.github.com/actions/labeler/issues/926\"\u003e#926\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/77a4082b841706ac431479b7e2bb11216ffef250\"\u003e\u003ccode\u003e77a4082\u003c/code\u003e\u003c/a\u003e Fix: Preserve manually added labels during workflow run and refine label sync...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/25abb3cad4f14b7ac27968a495c37798860a5a1a\"\u003e\u003ccode\u003e25abb3c\u003c/code\u003e\u003c/a\u003e Improve Labeler Action Documentation and Error Handling for Permissions (\u003ca href=\"https://redirect.github.com/actions/labeler/issues/897\"\u003e#897\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/395c8cfdb1e1e691cc4bad0dd315820af8eb67fd\"\u003e\u003ccode\u003e395c8cf\u003c/code\u003e\u003c/a\u003e Bump brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v...\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/labeler/compare/634933edcd8ababfe52f92936142cc22ac488b1b...f27b608878404679385c85cfa523b85ccb86e213\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action` from 2.3.5 to 2.3.8\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9517144e5504957104c831530fe605bfdc71f353\"\u003e\u003ccode\u003e9517144\u003c/code\u003e\u003c/a\u003e feat: output results in reusable workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f17cd09224d6ef8be953fb49371e6bffb2dbf44a\"\u003e\u003ccode\u003ef17cd09\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into main\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/c51854704019a247608d928f370c98740469d4b5...9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `release-drafter/release-drafter` from 7.2.1 to 7.3.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/release-drafter/release-drafter/releases\"\u003erelease-drafter/release-drafter's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.3.1\u003c/h2\u003e\n\u003ch1\u003eWhat's Changed\u003c/h1\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: output name and tag_name in dry-run mode (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1625\"\u003e#1625\u003c/a\u003e) \u003ca href=\"https://github.com/cchanche\"\u003e\u003ccode\u003e@​cchanche\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eMaintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): update graphql-codegen to 7.0.0 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1619\"\u003e#1619\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency nock to 14.0.15 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1609\"\u003e#1609\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update graphql-codegen (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1615\"\u003e#1615\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency typescript to 6.0.3 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1610\"\u003e#1610\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci(deps): update actions/download-artifact action to v8.0.1 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1620\"\u003e#1620\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency \u003ccode\u003e@​types/node\u003c/code\u003e to 24.12.3 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1608\"\u003e#1608\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update vitest to 4.1.5 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1612\"\u003e#1612\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency \u003ccode\u003e@​biomejs/biome\u003c/code\u003e to 2.4.15 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1607\"\u003e#1607\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency vite to 8.0.11 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1611\"\u003e#1611\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci(deps): pin dependencies (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1606\"\u003e#1606\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDependency Updates\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): update node.js to v24.15.0 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1616\"\u003e#1616\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update vite to v8.0.13 and vitest to v4.1.6 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1624\"\u003e#1624\u003c/a\u003e) \u003ca href=\"https://github.com/cchanche\"\u003e\u003ccode\u003e@​cchanche\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(deps): update dependency semver to 7.8.0 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1622\"\u003e#1622\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update npm tool constraint to 11.14.1 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1617\"\u003e#1617\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(deps): update dependency zod to 4.4.3 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1618\"\u003e#1618\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(deps): update actions (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1613\"\u003e#1613\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency \u003ccode\u003e@​biomejs/biome\u003c/code\u003e to 2.4.15 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1607\"\u003e#1607\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(deps): update dependency yaml to 2.8.4 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1614\"\u003e#1614\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/release-drafter/release-drafter/compare/v7.3.0...v7.3.1\"\u003ehttps://github.com/release-drafter/release-drafter/compare/v7.3.0...v7.3.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev7.3.0\u003c/h2\u003e\n\u003ch1\u003eWhat's Changed\u003c/h1\u003e\n\u003ch2\u003eNew\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: recover recently merged PRs missed by associated PRs lag (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1604\"\u003e#1604\u003c/a\u003e) \u003ca href=\"https://github.com/jetersen\"\u003e\u003ccode\u003e@​jetersen\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: switch release discovery to ref comparison and explicit missing-baseline warnings (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1570\"\u003e#1570\u003c/a\u003e) \u003ca href=\"https://github.com/jetersen\"\u003e\u003ccode\u003e@​jetersen\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: restore prerelease-identifier on first run when no prior releases exist (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1602\"\u003e#1602\u003c/a\u003e) \u003ca href=\"https://github.com/jrbeilke\"\u003e\u003ccode\u003e@​jrbeilke\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: prevent using commitish like refs/pull (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1598\"\u003e#1598\u003c/a\u003e) \u003ca href=\"https://github.com/cchanche\"\u003e\u003ccode\u003e@​cchanche\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/693d20e7c1ce1a81d3a41962f85914253b518449\"\u003e\u003ccode\u003e693d20e\u003c/code\u003e\u003c/a\u003e chore: release v7.3.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/8339e41baa2bbe599e9144446202a730b0b512dc\"\u003e\u003ccode\u003e8339e41\u003c/code\u003e\u003c/a\u003e docs: update contributing docs for release process\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/62d8da40388ce452db900d9dd413236c55d8527b\"\u003e\u003ccode\u003e62d8da4\u003c/code\u003e\u003c/a\u003e fix: output name and tag_name in dry-run mode (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1625\"\u003e#1625\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/2c6d3958ca8ff5559d1816902d569397e6e7cd40\"\u003e\u003ccode\u003e2c6d395\u003c/code\u003e\u003c/a\u003e chore(deps): update node.js to v24.15.0 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1616\"\u003e#1616\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/3b62240da12f1ebb0e312c0e333efb7c975c9f83\"\u003e\u003ccode\u003e3b62240\u003c/code\u003e\u003c/a\u003e chore(deps): update vite to v8.0.13 and vitest to v4.1.6 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1624\"\u003e#1624\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/446e1517c52f0f2658eccfb62fe528f3c863e2ce\"\u003e\u003ccode\u003e446e151\u003c/code\u003e\u003c/a\u003e fix(deps): adapt to graphql-codegen 7 type changes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/4cd06dcb5f73b1a2c718f7902ca013a7b3ebffc1\"\u003e\u003ccode\u003e4cd06dc\u003c/code\u003e\u003c/a\u003e chore(deps): update graphql-codegen to 7.0.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/80457684ebeb5980a2523289611de1d198148dc0\"\u003e\u003ccode\u003e8045768\u003c/code\u003e\u003c/a\u003e fix(deps): update dependency semver to 7.8.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/1cf836b3aa269940ddd548267ab0a35726568d79\"\u003e\u003ccode\u003e1cf836b\u003c/code\u003e\u003c/a\u003e ci(release): use local action for publish step\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/485c120935331ce9b7d39543ad7441a80d6c7194\"\u003e\u003ccode\u003e485c120\u003c/code\u003e\u003c/a\u003e chore(deps): update npm tool constraint to 11.14.1\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/release-drafter/release-drafter/compare/563bf132657a13ded0b01fcb723c5a58cdd824e2...693d20e7c1ce1a81d3a41962f85914253b518449\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `sigstore/cosign-installer` from 4.1.1 to 4.1.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/sigstore/cosign-installer/releases\"\u003esigstore/cosign-installer's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.1.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump cosign to 3.0.6 in \u003ca href=\"https://redirect.github.com/sigstore/cosign-installer/pull/232\"\u003esigstore/cosign-installer#232\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sigstore/cosign-installer/commit/6f9f17788090df1f26f669e9d70d6ae9567deba6\"\u003e\u003ccode\u003e6f9f177\u003c/code\u003e\u003c/a\u003e Bump cosign to 3.0.6 (\u003ca href=\"https://redirect.github.com/sigstore/cosign-installer/issues/232\"\u003e#232\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sigstore/cosign-installer/commit/b5e753ae2d39589c7b38850b463739151fc67f07\"\u003e\u003ccode\u003eb5e753a\u003c/code\u003e\u003c/a\u003e Bump actions/github-script from 8.0.0 to 9.0.0 (\u003ca href=\"https://redirect.github.com/sigstore/cosign-installer/issues/230\"\u003e#230\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sigstore/cosign-installer/commit/115e4ce455e573aa6e9ba51e8d040ddd5c1378af\"\u003e\u003ccode\u003e115e4ce\u003c/code\u003e\u003c/a\u003e Bump actions/setup-go from 6.3.0 to 6.4.0 (\u003ca href=\"https://redirect.github.com/sigstore/cosign-installer/issues/226\"\u003e#226\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/sigstore/cosign-installer/compare/cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003...6f9f17788090df1f26f669e9d70d6ae9567deba6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `docker/setup-buildx-action` from 4.0.0 to 4.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/docker/setup-buildx-action/releases\"\u003edocker/setup-buildx-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.1.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.79.0 to 0.90.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/489\"\u003edocker/setup-buildx-action#489\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump brace-expansion from 1.1.12 to 5.0.6 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/547\"\u003edocker/setup-buildx-action#547\u003c/a\u003e \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/508\"\u003edocker/setup-buildx-action#508\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump fast-xml-builder from 1.0.0 to 1.2.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/540\"\u003edocker/setup-buildx-action#540\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump fast-xml-parser from 5.4.2 to 5.8.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/496\"\u003edocker/setup-buildx-action#496\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.3 to 3.4.2 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/499\"\u003edocker/setup-buildx-action#499\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump glob from 10.3.12 to 13.0.6 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/495\"\u003edocker/setup-buildx-action#495\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump handlebars from 4.7.8 to 4.7.9 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/504\"\u003edocker/setup-buildx-action#504\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump lodash from 4.17.23 to 4.18.1 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/523\"\u003edocker/setup-buildx-action#523\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump picomatch from 4.0.3 to 4.0.4 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/503\"\u003edocker/setup-buildx-action#503\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump postcss from 8.5.6 to 8.5.10 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/537\"\u003edocker/setup-buildx-action#537\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump tar from 6.2.1 to 7.5.15 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/545\"\u003edocker/setup-buildx-action#545\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 6.23.0 to 6.25.0 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/492\"\u003edocker/setup-buildx-action#492\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump vite from 7.3.1 to 7.3.2 in \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/pull/520\"\u003edocker/setup-buildx-action#520\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/v4.0.0...v4.1.0\"\u003ehttps://github.com/docker/setup-buildx-action/compare/v4.0.0...v4.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5\"\u003e\u003ccode\u003ed7f5e7f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/489\"\u003e#489\u003c/a\u003e from docker/dependabot/npm_and_yarn/docker/actions-to...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/92bc5c9777806d0a73d9d668ba2114fa1177f164\"\u003e\u003ccode\u003e92bc5c9\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/da11e35abee0f20cb4f1c1b7c461d37c29be52f5\"\u003e\u003ccode\u003eda11e35\u003c/code\u003e\u003c/a\u003e build(deps): bump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.79.0 to 0.90.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/f021e162ef95b6fba51af1c6674f537f25bce851\"\u003e\u003ccode\u003ef021e16\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/492\"\u003e#492\u003c/a\u003e from docker/dependabot/npm_and_yarn/undici-6.24.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/b5af94fab700aee0c64d6077e0e34ae987815b67\"\u003e\u003ccode\u003eb5af94f\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/16ad9776a801d0c47f0a05f007b88a3789aa8ab6\"\u003e\u003ccode\u003e16ad977\u003c/code\u003e\u003c/a\u003e build(deps): bump undici from 6.23.0 to 6.25.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/d7a12d7df895b33bd02a9b4bf62a12f2b9a24458\"\u003e\u003ccode\u003ed7a12d7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/495\"\u003e#495\u003c/a\u003e from docker/dependabot/npm_and_yarn/glob-10.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/28ff27de4eed7518d361591f2cd1dfb69c34a7cb\"\u003e\u003ccode\u003e28ff27d\u003c/code\u003e\u003c/a\u003e build(deps): bump glob from 10.3.12 to 13.0.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/daf436b50e13d9053b9730cbc16516891878b019\"\u003e\u003ccode\u003edaf436b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/setup-buildx-action/issues/496\"\u003e#496\u003c/a\u003e from docker/dependabot/npm_and_yarn/fast-xml-parser-5...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/setup-buildx-action/commit/9725348367859764880f2f2e688a6b0c353e3f35\"\u003e\u003ccode\u003e9725348\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/docker/setup-buildx-action/compare/4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd...d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `docker/login-action` from 4.1.0 to 4.2.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/docker/login-action/releases\"\u003edocker/login-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.2.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e from 3.0.0 to 3.0.1 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/976\"\u003edocker/login-action#976\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​aws-sdk/client-ecr\u003c/code\u003e and \u003ccode\u003e@​aws-sdk/client-ecr-public\u003c/code\u003e to 3.1050.0 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/960\"\u003edocker/login-action#960\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.86.0 to 0.90.0 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/970\"\u003edocker/login-action#970\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump brace-expansion from 2.0.1 to 5.0.6 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/993\"\u003edocker/login-action#993\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump fast-xml-builder from 1.1.4 to 1.2.0 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/985\"\u003edocker/login-action#985\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump fast-xml-parser from 5.3.6 to 5.8.0 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/963\"\u003edocker/login-action#963\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump http-proxy-agent and https-proxy-agent to 9.0.0 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/961\"\u003edocker/login-action#961\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump postcss from 8.5.6 to 8.5.10 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/979\"\u003edocker/login-action#979\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump tar from 6.2.1 to 7.5.15 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/991\"\u003edocker/login-action#991\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump vite from 7.3.1 to 7.3.3 in \u003ca href=\"https://redirect.github.com/docker/login-action/pull/986\"\u003edocker/login-action#986\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/docker/login-action/compare/v4.1.0...v4.2.0\"\u003ehttps://github.com/docker/login-action/compare/v4.1.0...v4.2.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/650006c6eb7dba73a995cc03b0b2d7f5ca915bee\"\u003e\u003ccode\u003e650006c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/login-action/issues/960\"\u003e#960\u003c/a\u003e from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/99df1a3f6d65e48177ea57671a50e2242eae4b63\"\u003e\u003ccode\u003e99df1a3\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/3ab375f324f46da5f6901efeda4be4e2566ebaa2\"\u003e\u003ccode\u003e3ab375f\u003c/code\u003e\u003c/a\u003e build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/39d85804ae465a1816c68ff58158ec66883981b4\"\u003e\u003ccode\u003e39d8580\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/login-action/issues/970\"\u003e#970\u003c/a\u003e from docker/dependabot/npm_and_yarn/docker/actions-to...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/4eefcd33ca7213989697445a78b6730274bfaba6\"\u003e\u003ccode\u003e4eefcd3\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/56d092c8b3f04006c22f4fc20a2b3d2442caed56\"\u003e\u003ccode\u003e56d092c\u003c/code\u003e\u003c/a\u003e build(deps): bump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.86.0 to 0.90.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/e2e31ca87063ae00fd41ad3b9c548dd8ec24c5ff\"\u003e\u003ccode\u003ee2e31ca\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/login-action/issues/976\"\u003e#976\u003c/a\u003e from docker/dependabot/npm_and_yarn/actions/core-3.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/0bced941e843afc786fbfd58b1c6c13ca11e09c9\"\u003e\u003ccode\u003e0bced94\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/3e75a0f266b07e09777a621d0ca5f4432ef9f10c\"\u003e\u003ccode\u003e3e75a0f\u003c/code\u003e\u003c/a\u003e build(deps): bump \u003ccode\u003e@​actions/core\u003c/code\u003e from 3.0.0 to 3.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/docker/login-action/commit/365bebd9d646160567ebad47824f026e09ee6970\"\u003e\u003ccode\u003e365bebd\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/docker/login-action/issues/984\"\u003e#984\u003c/a\u003e from docker/dependabot/github_actions/aws-actions/con...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/docker/login-action/compare/4907a6ddec9925e35a0a9e82d7399ccc52663121...650006c6eb7dba73a995cc03b0b2d7f5ca915bee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `crate-ci/typos` from 1.45.2 to 1.46.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/crate-ci/typos/releases\"\u003ecrate-ci/typos's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.46.3\u003c/h2\u003e\n\u003ch2\u003e[1.46.3] - 2026-05-23\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003esequentials\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003esubdolder\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.46.2\u003c/h2\u003e\n\u003ch2\u003e[1.46.2] - 2026-05-16\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003ecriterias\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003ereplaceables\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.46.1\u003c/h2\u003e\n\u003ch2\u003e[1.46.1] - 2026-05-08\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003econfidentials\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.46.0\u003c/h2\u003e\n\u003ch2\u003e[1.46.0] - 2026-04-30\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated the dictionary with the \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1531\"\u003eApril 2026\u003c/a\u003e changes\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/crate-ci/typos/blob/master/CHANGELOG.md\"\u003ecrate-ci/typos's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChange Log\u003c/h1\u003e\n\u003cp\u003eAll notable changes to this project will be documented in this file.\u003c/p\u003e\n\u003cp\u003eThe format is based on \u003ca href=\"https://keepachangelog.com/\"\u003eKeep a Changelog\u003c/a\u003e\nand this project adheres to \u003ca href=\"https://semver.org/\"\u003eSemantic Versioning\u003c/a\u003e.\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003e[Unreleased] - ReleaseDate\u003c/h2\u003e\n\u003ch2\u003e[1.46.3] - 2026-05-23\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003esequentials\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003esubdolder\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.46.2] - 2026-05-16\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003ecriterias\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003ereplaceables\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.46.1] - 2026-05-08\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003econfidentials\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.46.0] - 2026-04-30\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated the dictionary with the \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1531\"\u003eApril 2026\u003c/a\u003e changes\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.45.2] - 2026-04-27\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eIgnore ssh ed25519 public keys\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.45.1] - 2026-04-13\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003e(action)\u003c/em\u003e Use a temp dir for caching\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.45.0] - 2026-04-01\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/7b04f660f4ee4f048d18fd341887cf28dfbedfe2\"\u003e\u003ccode\u003e7b04f66\u003c/code\u003e\u003c/a\u003e chore: Release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/6eefe9fe8912c8838f92bc036e3a6deb5980a5d6\"\u003e\u003ccode\u003e6eefe9f\u003c/code\u003e\u003c/a\u003e docs: Update changelog\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/27ae304665df6c1ed33363f179c1656fc03de0f1\"\u003e\u003ccode\u003e27ae304\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1559\"\u003e#1559\u003c/a\u003e from epage/fixes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/5b01f667d285db3c07f1f6f6e5915550d474e364\"\u003e\u003ccode\u003e5b01f66\u003c/code\u003e\u003c/a\u003e fix(dict): Don't correct to sequentials\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/4dbd644b8d3d4b8d25b0993b924bf84bfec4f8f8\"\u003e\u003ccode\u003e4dbd644\u003c/code\u003e\u003c/a\u003e fix(dict): Don't correct to subdolder\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/aca895bf05aec0cb7dffa6f94495e923224d9f17\"\u003e\u003ccode\u003eaca895b\u003c/code\u003e\u003c/a\u003e chore: Release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/4dbdd7509d345c6a2abf73bb722a2ae0126eec72\"\u003e\u003ccode\u003e4dbdd75\u003c/code\u003e\u003c/a\u003e docs: Update changelog\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/3da287673172dece00f174b38faa763e7cb294dc\"\u003e\u003ccode\u003e3da2876\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1556\"\u003e#1556\u003c/a\u003e from epage/replaceable\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/8918680477461d6cb133f4565eaa70f8237e27ae\"\u003e\u003ccode\u003e8918680\u003c/code\u003e\u003c/a\u003e fix(dict): Don't correct to replaceables\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/57d5422e87c3d28c9b9a61785ac5e8e0fcaae205\"\u003e\u003ccode\u003e57d5422\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1555\"\u003e#1555\u003c/a\u003e from epage/criteria\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/crate-ci/typos/compare/7c572958218557a3272c2d6719629443b5cc26fd...7b04f660f4ee4f048d18fd341887cf28dfbedfe2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cde...\n\n_Description has been truncated_","html_url":"https://github.com/afadesigns/zshellcheck/pull/1335","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/afadesigns%2Fzshellcheck/issues/1335","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/1335/packages"}},{"old_version":"2.3.5","new_version":"2.3.8","update_type":"patch","path":null,"pr_created_at":"2026-05-23T00:28:17.000Z","version_change":"2.3.5 → 2.3.8","issue":{"uuid":"4506247754","node_id":"PR_kwDOSe3Vr87ehtnF","number":2,"state":"closed","title":"chore(deps): bump the github-actions group across 1 directory with 14 updates","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":"2026-05-30T01:01:37.000Z","author_association":null,"state_reason":null,"created_at":"2026-05-23T00:28:17.000Z","updated_at":"2026-05-30T01:01:39.000Z","time_to_close":606800,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"github-actions","update_count":14,"packages":[{"name":"actions/checkout","old_version":"3.1.0","new_version":"6.0.2","repository_url":"https://github.com/actions/checkout"},{"name":"step-security/harden-runner","old_version":"2.19.0","new_version":"2.19.4","repository_url":"https://github.com/step-security/harden-runner"},{"name":"golangci/golangci-lint-action","old_version":"9.2.0","new_version":"9.2.1","repository_url":"https://github.com/golangci/golangci-lint-action"},{"name":"codecov/codecov-action","old_version":"6.0.0","new_version":"6.0.1","repository_url":"https://github.com/codecov/codecov-action"},{"name":"github/codeql-action","old_version":"2.1.36","new_version":"4.36.0","repository_url":"https://github.com/github/codeql-action"},{"name":"actions/dependency-review-action","old_version":"4.9.0","new_version":"5.0.0","repository_url":"https://github.com/actions/dependency-review-action"},{"name":"goreleaser/goreleaser-action","old_version":"7.2.1","new_version":"7.2.2","repository_url":"https://github.com/goreleaser/goreleaser-action"},{"name":"actions/labeler","old_version":"6.0.1","new_version":"6.1.0","repository_url":"https://github.com/actions/labeler"},{"name":"google/osv-scanner-action","old_version":"2.3.5","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"release-drafter/release-drafter","old_version":"7.2.1","new_version":"7.3.0","repository_url":"https://github.com/release-drafter/release-drafter"},{"name":"sigstore/cosign-installer","old_version":"4.1.1","new_version":"4.1.2","repository_url":"https://github.com/sigstore/cosign-installer"},{"name":"docker/setup-buildx-action","old_version":"4.0.0","new_version":"4.1.0","repository_url":"https://github.com/docker/setup-buildx-action"},{"name":"docker/login-action","old_version":"4.1.0","new_version":"4.2.0","repository_url":"https://github.com/docker/login-action"},{"name":"crate-ci/typos","old_version":"1.45.2","new_version":"1.46.2","repository_url":"https://github.com/crate-ci/typos"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions group with 14 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/checkout](https://github.com/actions/checkout) | `3.1.0` | `6.0.2` |\n| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.19.0` | `2.19.4` |\n| [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `9.2.0` | `9.2.1` |\n| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `6.0.0` | `6.0.1` |\n| [github/codeql-action](https://github.com/github/codeql-action) | `2.1.36` | `4.36.0` |\n| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.9.0` | `5.0.0` |\n| [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `7.2.1` | `7.2.2` |\n| [actions/labeler](https://github.com/actions/labeler) | `6.0.1` | `6.1.0` |\n| [google/osv-scanner-action](https://github.com/google/osv-scanner-action) | `2.3.5` | `2.3.8` |\n| [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) | `7.2.1` | `7.3.0` |\n| [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `4.1.1` | `4.1.2` |\n| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.0.0` | `4.1.0` |\n| [docker/login-action](https://github.com/docker/login-action) | `4.1.0` | `4.2.0` |\n| [crate-ci/typos](https://github.com/crate-ci/typos) | `1.45.2` | `1.46.2` |\n\n\nUpdates `actions/checkout` from 3.1.0 to 6.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/releases\"\u003eactions/checkout's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by \u003ca href=\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2355\"\u003eactions/checkout#2355\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6.0.1...v6.0.2\"\u003ehttps://github.com/actions/checkout/compare/v6.0.1...v6.0.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all references from v5 and v4 to v6 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2314\"\u003eactions/checkout#2314\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eClarify v6 README by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2328\"\u003eactions/checkout#2328\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6...v6.0.1\"\u003ehttps://github.com/actions/checkout/compare/v6...v6.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ev6-beta by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2298\"\u003eactions/checkout#2298\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate readme/changelog for v6 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2311\"\u003eactions/checkout#2311\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v5.0.0...v6.0.0\"\u003ehttps://github.com/actions/checkout/compare/v5.0.0...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6-beta\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eUpdated persist-credentials to store the credentials under \u003ccode\u003e$RUNNER_TEMP\u003c/code\u003e instead of directly in the local git config.\u003c/p\u003e\n\u003cp\u003eThis requires a minimum Actions Runner version of \u003ca href=\"https://github.com/actions/runner/releases/tag/v2.329.0\"\u003ev2.329.0\u003c/a\u003e to access the persisted credentials for \u003ca href=\"https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action\"\u003eDocker container action\u003c/a\u003e scenarios.\u003c/p\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v5...v5.0.1\"\u003ehttps://github.com/actions/checkout/compare/v5...v5.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare v5.0.0 release by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2238\"\u003eactions/checkout#2238\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e⚠️ Minimum Compatible Runner Version\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003ev2.327.1\u003c/strong\u003e\u003cbr /\u003e\n\u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003eRelease Notes\u003c/a\u003e\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\"\u003eactions/checkout's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v4 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2305\"\u003eactions/checkout#2305\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update README.md by \u003ca href=\"https://github.com/motss\"\u003e\u003ccode\u003e@​motss\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1971\"\u003eactions/checkout#1971\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd internal repos for checking out multiple repositories by \u003ca href=\"https://github.com/mouismail\"\u003e\u003ccode\u003e@​mouismail\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1977\"\u003eactions/checkout#1977\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation update - add recommended permissions to Readme by \u003ca href=\"https://github.com/benwells\"\u003e\u003ccode\u003e@​benwells\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2043\"\u003eactions/checkout#2043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdjust positioning of user email note and permissions heading by \u003ca href=\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2044\"\u003eactions/checkout#2044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca href=\"https://github.com/nebuk89\"\u003e\u003ccode\u003e@​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2194\"\u003eactions/checkout#2194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate CODEOWNERS for actions by \u003ca href=\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2224\"\u003eactions/checkout#2224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate package dependencies by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2236\"\u003eactions/checkout#2236\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eurl-helper.ts\u003c/code\u003e now leverages well-known environment variables by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1941\"\u003eactions/checkout#1941\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpand unit test coverage for \u003ccode\u003eisGhes\u003c/code\u003e by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1946\"\u003eactions/checkout#1946\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck out other refs/* by commit if provided, fall back to ref by \u003ca href=\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1924\"\u003eactions/checkout#1924\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd Ref and Commit outputs by \u003ca href=\"https://github.com/lucacome\"\u003e\u003ccode\u003e@​lucacome\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1180\"\u003eactions/checkout#1180\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDependency updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e- \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1777\"\u003eactions/checkout#1777\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1872\"\u003eactions/checkout#1872\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.1.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1739\"\u003eactions/checkout#1739\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 3 to 4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1697\"\u003eactions/checkout#1697\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCheck out other refs/* by commit by \u003ca href=\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1774\"\u003eactions/checkout#1774\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin actions/checkout's own workflows to a known, good, stable version. by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1776\"\u003eactions/checkout#1776\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.1.6\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck platform to set archive extension appropriately by \u003ca href=\"https://github.com/cory-miller\"\u003e\u003ccode\u003e@​cory-miller\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1732\"\u003eactions/checkout#1732\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/de0fac2e4500dabe0009e67214ff5f5447ce83dd\"\u003e\u003ccode\u003ede0fac2\u003c/code\u003e\u003c/a\u003e Fix tag handling: preserve annotations and explicit fetch-tags (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2356\"\u003e#2356\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/064fe7f3312418007dea2b49a19844a9ee378f49\"\u003e\u003ccode\u003e064fe7f\u003c/code\u003e\u003c/a\u003e Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/8e8c483db84b4bee98b60c0593521ed34d9990e8\"\u003e\u003ccode\u003e8e8c483\u003c/code\u003e\u003c/a\u003e Clarify v6 README (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2328\"\u003e#2328\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/033fa0dc0b82693d8986f1016a0ec2c5e7d9cbb1\"\u003e\u003ccode\u003e033fa0d\u003c/code\u003e\u003c/a\u003e Add worktree support for persist-credentials includeIf (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2327\"\u003e#2327\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5\"\u003e\u003ccode\u003ec2d88d3\u003c/code\u003e\u003c/a\u003e Update all references from v5 and v4 to v6 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2314\"\u003e#2314\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3\"\u003e\u003ccode\u003e1af3b93\u003c/code\u003e\u003c/a\u003e update readme/changelog for v6 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2311\"\u003e#2311\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/71cf2267d89c5cb81562390fa70a37fa40b1305e\"\u003e\u003ccode\u003e71cf226\u003c/code\u003e\u003c/a\u003e v6-beta (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2298\"\u003e#2298\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/069c6959146423d11cd0184e6accf28f9d45f06e\"\u003e\u003ccode\u003e069c695\u003c/code\u003e\u003c/a\u003e Persist creds to a separate file (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2286\"\u003e#2286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493\"\u003e\u003ccode\u003eff7abcd\u003c/code\u003e\u003c/a\u003e Update README to include Node.js 24 support details and requirements (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2248\"\u003e#2248\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/08c6903cd8c0fde910a37f88322edcfb5dd907a8\"\u003e\u003ccode\u003e08c6903\u003c/code\u003e\u003c/a\u003e Prepare v5.0.0 release (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2238\"\u003e#2238\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/checkout/compare/v3.1.0...de0fac2e4500dabe0009e67214ff5f5447ce83dd\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `step-security/harden-runner` from 2.19.0 to 2.19.4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/step-security/harden-runner/releases\"\u003estep-security/harden-runner's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.19.4\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImprovements for HTTPS Monitoring for the Enterprise tier of Harden Runner\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.3...v2.19.4\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.3...v2.19.4\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.3\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDefault to audit mode when api-key missing with use-policy-store by \u003ca href=\"https://github.com/varunsh-coder\"\u003e\u003ccode\u003e@​varunsh-coder\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/665\"\u003estep-security/harden-runner#665\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: detect ubuntu-slim runners early and bail out by \u003ca href=\"https://github.com/devantler\"\u003e\u003ccode\u003e@​devantler\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/657\"\u003estep-security/harden-runner#657\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eWhat the fix changes\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eHarden-Runner will detect \u003ccode\u003eubuntu-slim\u003c/code\u003e runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eWhat the fix does not do\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eJobs running on \u003ccode\u003eubuntu-slim\u003c/code\u003e will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).\u003c/li\u003e\n\u003cli\u003ePer GitHub's docs on \u003ca href=\"https://docs.github.com/en/actions/reference/runners/github-hosted-runners#single-cpu-runners\"\u003esingle-CPU runners\u003c/a\u003e: \u0026quot;The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported.\u0026quot;  Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eFor StepSecurity enterprise customers\nIf your security posture requires that workflows are always monitored, you can block the use of \u003ccode\u003eubuntu-slim\u003c/code\u003e via workflow run policies see the \u003ca href=\"https://docs.stepsecurity.io/workflow-run-policies/policies#runner-label-policy\"\u003eRunner Label Policy\u003c/a\u003e docs. This lets you enforce that jobs only run on monitored runner types.\u003c/p\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/devantler\"\u003e\u003ccode\u003e@​devantler\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/657\"\u003estep-security/harden-runner#657\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/9af89fc71515a100421586dfdb3dc9c984fbf411\"\u003e\u003ccode\u003e9af89fc\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/667\"\u003e#667\u003c/a\u003e from step-security/update-agent-v1.8.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/485dce8cb5d75cda51e8bfa947de06030d080208\"\u003e\u003ccode\u003e485dce8\u003c/code\u003e\u003c/a\u003e Update agent to v1.8.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ab7a9404c0f3da075243ca237b5fac12c98deaa5\"\u003e\u003ccode\u003eab7a940\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/665\"\u003e#665\u003c/a\u003e from step-security/fix/use-policy-store-default-audit\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ec41b783c27ed7f0db6855a6d9970abd4572858c\"\u003e\u003ccode\u003eec41b78\u003c/code\u003e\u003c/a\u003e Default to audit mode when api-key missing with use-policy-store\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/9ca718d3bf646d6534007c269a635b3e54cadf99\"\u003e\u003ccode\u003e9ca718d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/664\"\u003e#664\u003c/a\u003e from step-security/update-agent-v1.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/1dee3df8d29f4225c582eee2ddb6053ca616c0df\"\u003e\u003ccode\u003e1dee3df\u003c/code\u003e\u003c/a\u003e Update agent to v1.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/a5ad31d6a139d249332a2605b85202e8c0b78450\"\u003e\u003ccode\u003ea5ad31d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/657\"\u003e#657\u003c/a\u003e from devantler/fix/ubuntu-slim-user-env\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/6e928567d74554b8842dd434908da31c593ba85c\"\u003e\u003ccode\u003e6e92856\u003c/code\u003e\u003c/a\u003e build dist and trim ubuntu-slim message\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/4e0504ee086374bdec7064e5c26d48af41ba6209\"\u003e\u003ccode\u003e4e0504e\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into fix/ubuntu-slim-user-env\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/376d25a97f3a1640ff8cbbddaa4af25948df2cf3\"\u003e\u003ccode\u003e376d25a\u003c/code\u003e\u003c/a\u003e fix: detect ubuntu-slim runners early and bail out\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/step-security/harden-runner/compare/8d3c67de8e2fe68ef647c8db1e6a09f647780f40...9af89fc71515a100421586dfdb3dc9c984fbf411\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `golangci/golangci-lint-action` from 9.2.0 to 9.2.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/golangci/golangci-lint-action/releases\"\u003egolangci/golangci-lint-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev9.2.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eIMPORTANT: this is the first immutable release.\u003c/p\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003echore: improve workflows by \u003ca href=\"https://github.com/ldez\"\u003e\u003ccode\u003e@​ldez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1394\"\u003egolangci/golangci-lint-action#1394\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependencies\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1325\"\u003egolangci/golangci-lint-action#1325\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1326\"\u003egolangci/golangci-lint-action#1326\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump the dependencies group with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1327\"\u003egolangci/golangci-lint-action#1327\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1328\"\u003egolangci/golangci-lint-action#1328\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 25.0.2 to 25.0.3 in the dependencies group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1329\"\u003egolangci/golangci-lint-action#1329\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1330\"\u003egolangci/golangci-lint-action#1330\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1332\"\u003egolangci/golangci-lint-action#1332\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1333\"\u003egolangci/golangci-lint-action#1333\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump the dependencies group with 6 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1334\"\u003egolangci/golangci-lint-action#1334\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1335\"\u003egolangci/golangci-lint-action#1335\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump the dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1336\"\u003egolangci/golangci-lint-action#1336\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1337\"\u003egolangci/golangci-lint-action#1337\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 25.0.9 to 25.0.10 in the dependencies group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1338\"\u003egolangci/golangci-lint-action#1338\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.3.3 to 5.3.4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1339\"\u003egolangci/golangci-lint-action#1339\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1340\"\u003egolangci/golangci-lint-action#1340\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1344\"\u003egolangci/golangci-lint-action#1344\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.3.4 to 5.3.6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1346\"\u003egolangci/golangci-lint-action#1346\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump minimatch by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1348\"\u003egolangci/golangci-lint-action#1348\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump minimatch from 3.1.3 to 3.1.5 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1350\"\u003egolangci/golangci-lint-action#1350\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.3.6 to 5.4.1 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1351\"\u003egolangci/golangci-lint-action#1351\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.4.1 to 5.5.6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1357\"\u003egolangci/golangci-lint-action#1357\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-parser from 5.5.6 to 5.5.7 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1358\"\u003egolangci/golangci-lint-action#1358\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump flatted from 3.3.3 to 3.4.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1359\"\u003egolangci/golangci-lint-action#1359\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump picomatch from 4.0.3 to 4.0.4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1364\"\u003egolangci/golangci-lint-action#1364\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump yaml from 2.8.2 to 2.8.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1365\"\u003egolangci/golangci-lint-action#1365\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump brace-expansion by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1370\"\u003egolangci/golangci-lint-action#1370\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates by \u003ca href=\"https://github.com/ldez\"\u003e\u003ccode\u003e@​ldez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1374\"\u003egolangci/golangci-lint-action#1374\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 4 to 4.35.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1384\"\u003egolangci/golangci-lint-action#1384\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump fast-xml-builder from 1.1.5 to 1.2.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1386\"\u003egolangci/golangci-lint-action#1386\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1389\"\u003egolangci/golangci-lint-action#1389\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/pull/1391\"\u003egolangci/golangci-lint-action#1391\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/golangci/golangci-lint-action/compare/v9.2.0...v9.2.1\"\u003ehttps://github.com/golangci/golangci-lint-action/compare/v9.2.0...v9.2.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/82606bf257cbaff209d206a39f5134f0cfbfd2ee\"\u003e\u003ccode\u003e82606bf\u003c/code\u003e\u003c/a\u003e chore: prepare release v9.2.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/97c8387e660fa3be78f698fb592523e1f906a02c\"\u003e\u003ccode\u003e97c8387\u003c/code\u003e\u003c/a\u003e chore: improve workflows (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1394\"\u003e#1394\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/28d0a191bb76f633872d1f12600dd9900ac73840\"\u003e\u003ccode\u003e28d0a19\u003c/code\u003e\u003c/a\u003e build(deps): bump the dependencies group across 1 directory with 2 updates\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/633fbc7d54a1fe7d54f72fb83194a7d442beb929\"\u003e\u003ccode\u003e633fbc7\u003c/code\u003e\u003c/a\u003e build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1391\"\u003e#1391\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/59f43e26c902dadac745307f8cf2537da50ad344\"\u003e\u003ccode\u003e59f43e2\u003c/code\u003e\u003c/a\u003e build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1389\"\u003e#1389\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/9eb174e04acac69b4b7f6602f9a5cc384ba59b45\"\u003e\u003ccode\u003e9eb174e\u003c/code\u003e\u003c/a\u003e build(deps): bump fast-xml-builder from 1.1.5 to 1.2.0 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1386\"\u003e#1386\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/4f52504dfb47d09a983372e869f643e9e0d4014b\"\u003e\u003ccode\u003e4f52504\u003c/code\u003e\u003c/a\u003e build(deps): bump github/codeql-action from 4 to 4.35.2 (\u003ca href=\"https://redirect.github.com/golangci/golangci-lint-action/issues/1384\"\u003e#1384\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/6f87dfdbd16618b59a5d86104adea6216152a47c\"\u003e\u003ccode\u003e6f87dfd\u003c/code\u003e\u003c/a\u003e docs: update examples\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/c9500d7aa7797b3e999034a3e6a0b9a4f18e8708\"\u003e\u003ccode\u003ec9500d7\u003c/code\u003e\u003c/a\u003e chore: improve workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/golangci/golangci-lint-action/commit/03b1faa37ed78712fa70fc44b56fa553f0d7a6bc\"\u003e\u003ccode\u003e03b1faa\u003c/code\u003e\u003c/a\u003e chore: improve issue templates\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/golangci/golangci-lint-action/compare/1e7e51e771db61008b38414a730f564565cf7c20...82606bf257cbaff209d206a39f5134f0cfbfd2ee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `codecov/codecov-action` from 6.0.0 to 6.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/codecov/codecov-action/releases\"\u003ecodecov/codecov-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: prevent template injection in run: steps (VULN-1652) by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1947\"\u003ecodecov/codecov-action#1947\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(release): 6.0.1 by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1949\"\u003ecodecov/codecov-action#1949\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1\"\u003ehttps://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md\"\u003ecodecov/codecov-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.5.2\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.1\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: overwrite pr number on fork by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1871\"\u003ecodecov/codecov-action#1871\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump actions/checkout from 4.2.2 to 5.0.0 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1868\"\u003ecodecov/codecov-action#1868\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1867\"\u003ecodecov/codecov-action#1867\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update to use local app/ dir by \u003ca href=\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e@​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1872\"\u003ecodecov/codecov-action#1872\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: fix typo in README by \u003ca href=\"https://github.com/datalater\"\u003e\u003ccode\u003e@​datalater\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1866\"\u003ecodecov/codecov-action#1866\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument a \u003ccode\u003ecodecov-cli\u003c/code\u003e version reference example by \u003ca href=\"https://github.com/webknjaz\"\u003e\u003ccode\u003e@​webknjaz\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1774\"\u003ecodecov/codecov-action#1774\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1861\"\u003ecodecov/codecov-action#1861\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1833\"\u003ecodecov/codecov-action#1833\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.0\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efeat: upgrade wrapper to 0.2.4 by \u003ca href=\"https://github.com/jviall\"\u003e\u003ccode\u003e@​jviall\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1864\"\u003ecodecov/codecov-action#1864\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin actions/github-script by Git SHA by \u003ca href=\"https://github.com/martincostello\"\u003e\u003ccode\u003e@​martincostello\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1859\"\u003ecodecov/codecov-action#1859\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: check reqs exist by \u003ca href=\"https://github.com/joseph-sentry\"\u003e\u003ccode\u003e@​joseph-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1835\"\u003ecodecov/codecov-action#1835\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: Typo in README by \u003ca href=\"https://github.com/spalmurray\"\u003e\u003ccode\u003e@​spalmurray\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1838\"\u003ecodecov/codecov-action#1838\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: Refine OIDC docs by \u003ca href=\"https://github.com/spalmurray\"\u003e\u003ccode\u003e@​spalmurray\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1837\"\u003ecodecov/codecov-action#1837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1829\"\u003ecodecov/codecov-action#1829\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.3\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by \u003ccode\u003e@​app/dependabot\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1822\"\u003ecodecov/codecov-action#1822\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: OIDC on forks by \u003ca href=\"https://github.com/joseph-sentry\"\u003e\u003ccode\u003e@​joseph-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/codecov/codecov-action/pull/1823\"\u003ecodecov/codecov-action#1823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/codecov/codecov-action/commit/e79a6962e0d4c0c17b229090214935d2e33f8354\"\u003e\u003ccode\u003ee79a696\u003c/code\u003e\u003c/a\u003e chore(release): 6.0.1 (\u003ca href=\"https://redirect.github.com/codecov/codecov-action/issues/1949\"\u003e#1949\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/codecov/codecov-action/commit/51e64229ac331acb0d7f7b17c67423995f991c79\"\u003e\u003ccode\u003e51e6422\u003c/code\u003e\u003c/a\u003e fix: prevent template injection in run: steps (VULN-1652) (\u003ca href=\"https://redirect.github.com/codecov/codecov-action/issues/1947\"\u003e#1947\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/codecov/codecov-action/compare/57e3a136b779b570ffcdbf80b3bdc90e7fab3de2...e79a6962e0d4c0c17b229090214935d2e33f8354\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action` from 2.1.36 to 4.36.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.36.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle version to 2.19.4. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal \u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will be enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for GitHub-internal use only, and may change without notice at any time. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning analysis for a PR with \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP OIDC are now accepted. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBest-effort connection tests for private registries now use \u003ccode\u003eGET\u003c/code\u003e requests instead of \u003ccode\u003eHEAD\u003c/code\u003e for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3853\"\u003e#3853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3\"\u003e2.25.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3865\"\u003e#3865\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe undocumented TRAP cache cleanup feature that could be enabled using the \u003ccode\u003eCODEQL_ACTION_CLEANUP_TRAP_CACHES\u003c/code\u003e environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the \u003ccode\u003etrap-caching: false\u003c/code\u003e input to the \u003ccode\u003einit\u003c/code\u003e Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3795\"\u003e#3795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3789\"\u003e#3789\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePython analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3794\"\u003e#3794\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3807\"\u003e#3807\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2\"\u003e2.25.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3823\"\u003e#3823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix incorrect minimum required Git version for \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e: it should have been 2.36.0, not 2.11.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3781\"\u003e#3781\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReduced the minimum Git version required for \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e from 2.38.0 to 2.11.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3767\"\u003e#3767\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1\"\u003e2.25.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3773\"\u003e#3773\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.34.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDowngrade default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3\"\u003e2.24.3\u003c/a\u003e due to issues with a small percentage of Actions and JavaScript analyses. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3762\"\u003e#3762\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.34.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded an experimental change which disables TRAP caching when \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3569\"\u003e#3569\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eWe are rolling out improved incremental analysis to C/C++ analyses that use build mode \u003ccode\u003enone\u003c/code\u003e. We expect this rollout to be complete by the end of April 2026. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3584\"\u003e#3584\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0\"\u003e2.25.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3585\"\u003e#3585\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.33.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3562\"\u003e#3562\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eTo opt out of this change:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eRepositories owned by an organization:\u003c/strong\u003e Create a custom repository property with the name \u003ccode\u003egithub-codeql-file-coverage-on-prs\u003c/code\u003e and the type \u0026quot;True/false\u0026quot;, then set this property to \u003ccode\u003etrue\u003c/code\u003e in the repository's settings. For more information, see \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003eManaging custom properties for repositories in your organization\u003c/a\u003e. Alternatively, if you are using an advanced setup workflow, you can set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUser-owned repositories using default setup:\u003c/strong\u003e Switch to an advanced setup workflow and set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUser-owned repositories using advanced setup:\u003c/strong\u003e Set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7211b7c8077ea37d8641b6271f6a365a22a5fbfa\"\u003e\u003ccode\u003e7211b7c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3927\"\u003e#3927\u003c/a\u003e from github/update-v4.36.0-ebc2d9e2b\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7740f2fb21add1d46278215acea47540db22f022\"\u003e\u003ccode\u003e7740f2f\u003c/code\u003e\u003c/a\u003e Update changelog for v4.36.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/ebc2d9e2bc247eec51bee8d4df806c4030eb0761\"\u003e\u003ccode\u003eebc2d9e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3926\"\u003e#3926\u003c/a\u003e from github/update-bundle/codeql-bundle-v2.25.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d1f74b777c95c777bf4f42ce4b250bc916e745c7\"\u003e\u003ccode\u003ed1f74b7\u003c/code\u003e\u003c/a\u003e Add changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/2dc40cec39bdc63d3561d74fa6100cebb0418ff4\"\u003e\u003ccode\u003e2dc40ce\u003c/code\u003e\u003c/a\u003e Update default bundle to codeql-bundle-v2.25.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/84498526a009a99c875e83ef4821a8ba52de7c22\"\u003e\u003ccode\u003e8449852\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3910\"\u003e#3910\u003c/a\u003e from github/henrymercer/repo-size-diff-check\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/72ac23c6d16b29fbe801e87e3439941558c53094\"\u003e\u003ccode\u003e72ac23c\u003c/code\u003e\u003c/a\u003e Update excluded required check list\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/c5297a28a2c3e6a8062041b58858bd7117cebe37\"\u003e\u003ccode\u003ec5297a2\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3919\"\u003e#3919\u003c/a\u003e from github/henrymercer/workflow-concurrency\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/8ffeae7d05bc1b914a009d197e64e4f5c9e14503\"\u003e\u003ccode\u003e8ffeae7\u003c/code\u003e\u003c/a\u003e CI: Automatically cancel non-generated workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/f3f52bf568dc44a1069faafa538caa6b1fec40c9\"\u003e\u003ccode\u003ef3f52bf\u003c/code\u003e\u003c/a\u003e Revert \u003ccode\u003egetErrorMessage\u003c/code\u003e import\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/v2.1.36...v4.36.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/dependency-review-action` from 4.9.0 to 5.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/dependency-review-action/releases\"\u003eactions/dependency-review-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e5.0.0\u003c/h2\u003e\n\u003cp\u003eThis is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version \u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003ev2.327.1\u003c/a\u003e to run.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd .github/copilot-instructions.md for Copilot coding agent by \u003ca href=\"https://github.com/ahpook\"\u003e\u003ccode\u003e@​ahpook\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1067\"\u003eactions/dependency-review-action#1067\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate Node.js runtime from 20 to 24 by \u003ca href=\"https://github.com/scottschreckengaust\"\u003e\u003ccode\u003e@​scottschreckengaust\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1084\"\u003eactions/dependency-review-action#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump spdx-license-ids from 3.0.20 to 3.0.23 by \u003ca href=\"https://github.com/mongolyy\"\u003e\u003ccode\u003e@​mongolyy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1091\"\u003eactions/dependency-review-action#1091\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: bump actions/checkout from v4 to v6 in workflow examples by \u003ca href=\"https://github.com/Marukome0743\"\u003e\u003ccode\u003e@​Marukome0743\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1077\"\u003eactions/dependency-review-action#1077\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: patched version display for advisories with non-strict semver ranges (e.g. Maven beta versions) by \u003ca href=\"https://github.com/tspascoal\"\u003e\u003ccode\u003e@​tspascoal\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1076\"\u003eactions/dependency-review-action#1076\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolve security findings by \u003ca href=\"https://github.com/AshelyTC\"\u003e\u003ccode\u003e@​AshelyTC\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1094\"\u003eactions/dependency-review-action#1094\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ev5.0.0 release branch by \u003ca href=\"https://github.com/ahpook\"\u003e\u003ccode\u003e@​ahpook\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1098\"\u003eactions/dependency-review-action#1098\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scottschreckengaust\"\u003e\u003ccode\u003e@​scottschreckengaust\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1084\"\u003eactions/dependency-review-action#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mongolyy\"\u003e\u003ccode\u003e@​mongolyy\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1091\"\u003eactions/dependency-review-action#1091\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Marukome0743\"\u003e\u003ccode\u003e@​Marukome0743\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1077\"\u003eactions/dependency-review-action#1077\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/dependency-review-action/compare/v4.9.0...v5.0.0\"\u003ehttps://github.com/actions/dependency-review-action/compare/v4.9.0...v5.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/a1d282b36b6f3519aa1f3fc636f609c47dddb294\"\u003e\u003ccode\u003ea1d282b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1098\"\u003e#1098\u003c/a\u003e from actions/ahpook/v5-release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/eb6c199c5a85c7387f1f0b02b3ba5c6364740695\"\u003e\u003ccode\u003eeb6c199\u003c/code\u003e\u003c/a\u003e update examples to show \u003ca href=\"https://github.com/v5\"\u003e\u003ccode\u003e@​v5\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/3943c2c5beaaaf1806eb3758273c203dabcbf89c\"\u003e\u003ccode\u003e3943c2c\u003c/code\u003e\u003c/a\u003e v5.0.0 release branch\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/454943c880b147adbfe7de0cdd3ece1c00882033\"\u003e\u003ccode\u003e454943c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1094\"\u003e#1094\u003c/a\u003e from actions/ashelytc/security-findings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/6d92a1228e9e9db334f02c09f84fe9217d2b4463\"\u003e\u003ccode\u003e6d92a12\u003c/code\u003e\u003c/a\u003e revert \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e update\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/a8e5a7e93695b41abf6d1083cd220bee39a720f0\"\u003e\u003ccode\u003ea8e5a7e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1076\"\u003e#1076\u003c/a\u003e from tspascoal/fix-version-matching-for-non-string-s...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/b6b7079031ef4ed61656c221988f1f3bcbf35101\"\u003e\u003ccode\u003eb6b7079\u003c/code\u003e\u003c/a\u003e update \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e to 8.40.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/821a21dd691f162c4c5c2e9754a344accde9a208\"\u003e\u003ccode\u003e821a21d\u003c/code\u003e\u003c/a\u003e update more dependencies\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/05aaaae45cf4c420de012addf2a72e3435ddaa63\"\u003e\u003ccode\u003e05aaaae\u003c/code\u003e\u003c/a\u003e run npm audit fix\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/55d3e754501fc13c84b95637ce51f135012d41ea\"\u003e\u003ccode\u003e55d3e75\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1077\"\u003e#1077\u003c/a\u003e from Marukome0743/docs/checkout\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/dependency-review-action/compare/2031cfc080254a8a887f58cffee85186f0e49e48...a1d282b36b6f3519aa1f3fc636f609c47dddb294\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `goreleaser/goreleaser-action` from 7.2.1 to 7.2.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/goreleaser/goreleaser-action/releases\"\u003egoreleaser/goreleaser-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.2.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eci(deps): bump the actions group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/560\"\u003egoreleaser/goreleaser-action#560\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: nightly resolution to select newest published release by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/562\"\u003egoreleaser/goreleaser-action#562\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/pull/562\"\u003egoreleaser/goreleaser-action#562\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/v7...v7.2.2\"\u003ehttps://github.com/goreleaser/goreleaser-action/compare/v7...v7.2.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89\"\u003e\u003ccode\u003e5daf1e9\u003c/code\u003e\u003c/a\u003e fix: nightly resolution to select newest published release (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/562\"\u003e#562\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/5cc7ebb73d78b8f1d7b03c568e7df999c2889ccf\"\u003e\u003ccode\u003e5cc7ebb\u003c/code\u003e\u003c/a\u003e ci: update actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/goreleaser/goreleaser-action/commit/702f5f91c9334614254ddeabeebaf820d707f0d6\"\u003e\u003ccode\u003e702f5f9\u003c/code\u003e\u003c/a\u003e ci(deps): bump the actions group with 3 updates (\u003ca href=\"https://redirect.github.com/goreleaser/goreleaser-action/issues/560\"\u003e#560\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/goreleaser/goreleaser-action/compare/1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8...5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/labeler` from 6.0.1 to 6.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/labeler/releases\"\u003eactions/labeler's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.1.0\u003c/h2\u003e\n\u003ch2\u003eEnhancements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd changed-files-labels-limit and max-files-changed configuration options to cap the number of labels added by \u003ca href=\"https://github.com/bluca\"\u003e\u003ccode\u003e@​bluca\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/923\"\u003eactions/labeler#923\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImprove Labeler Action documentation and permission error handling by \u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/897\"\u003eactions/labeler#897\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePreserve manually added labels during workflow runs and refine label synchronization logic by \u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/917\"\u003eactions/labeler#917\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDependency Updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/877\"\u003eactions/labeler#877\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade minimatch from 10.0.1 to 10.2.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/926\"\u003eactions/labeler#926\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade dependencies (\u003ccode\u003e@​actions/core\u003c/code\u003e, \u003ccode\u003e@​actions/github\u003c/code\u003e, js-yaml, minimatch, \u003ca href=\"https://github.com/typescript-eslint\"\u003e\u003ccode\u003e@​typescript-eslint\u003c/code\u003e\u003c/a\u003e) by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/934\"\u003eactions/labeler#934\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/897\"\u003eactions/labeler#897\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/bluca\"\u003e\u003ccode\u003e@​bluca\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/923\"\u003eactions/labeler#923\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/934\"\u003eactions/labeler#934\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/labeler/compare/v6...v6.1.0\"\u003ehttps://github.com/actions/labeler/compare/v6...v6.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/f27b608878404679385c85cfa523b85ccb86e213\"\u003e\u003ccode\u003ef27b608\u003c/code\u003e\u003c/a\u003e chore: upgrade dependencies (\u003ccode\u003e@​actions/core\u003c/code\u003e, \u003ccode\u003e@​actions/github\u003c/code\u003e, js-yaml, minimat...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/c5dadc2a45784a4b6adfcd20fea3465da3a5f904\"\u003e\u003ccode\u003ec5dadc2\u003c/code\u003e\u003c/a\u003e Add 'changed-files-labels-limit' and 'max-files-changed' configs to allow cap...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/e52e4fb63ed5cd0e07abaad9826b2a893ccb921f\"\u003e\u003ccode\u003ee52e4fb\u003c/code\u003e\u003c/a\u003e Bump minimatch from 10.0.1 to 10.2.3 (\u003ca href=\"https://redirect.github.com/actions/labeler/issues/926\"\u003e#926\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/77a4082b841706ac431479b7e2bb11216ffef250\"\u003e\u003ccode\u003e77a4082\u003c/code\u003e\u003c/a\u003e Fix: Preserve manually added labels during workflow run and refine label sync...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/25abb3cad4f14b7ac27968a495c37798860a5a1a\"\u003e\u003ccode\u003e25abb3c\u003c/code\u003e\u003c/a\u003e Improve Labeler Action Documentation and Error Handling for Permissions (\u003ca href=\"https://redirect.github.com/actions/labeler/issues/897\"\u003e#897\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/395c8cfdb1e1e691cc4bad0dd315820af8eb67fd\"\u003e\u003ccode\u003e395c8cf\u003c/code\u003e\u003c/a\u003e Bump brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v...\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/labeler/compare/634933edcd8ababfe52f92936142cc22ac488b1b...f27b608878404679385c85cfa523b85ccb86e213\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action` from 2.3.5 to 2.3.8\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9517144e5504957104c831530fe605bfdc71f353\"\u003e\u003ccode\u003e9517144\u003c/code\u003e\u003c/a\u003e feat: output results in reusab...\n\n_Description has been truncated_","html_url":"https://github.com/actions-marketplace-validations/afadesigns_zshellcheck/pull/2","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions-marketplace-validations%2Fafadesigns_zshellcheck/issues/2","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/2/packages"}},{"old_version":"1.9.1","new_version":"2.3.8","update_type":"major","path":null,"pr_created_at":"2026-05-18T06:04:44.000Z","version_change":"1.9.1 → 2.3.8","issue":{"uuid":"4466672747","node_id":"PR_kwDORqFcsM7chpJo","number":11,"state":"open","title":"Bump google/osv-scanner-action from 1.9.1 to 2.3.8","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-05-18T06:04:44.000Z","updated_at":"2026-05-18T06:04:44.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"google/osv-scanner-action","old_version":"1.9.1","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [google/osv-scanner-action](https://github.com/google/osv-scanner-action) from 1.9.1 to 2.3.8.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.5\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.5.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to v2.3.5 by \u003ca href=\"https://github.com/tobyhawker\"\u003e\u003ccode\u003e@​tobyhawker\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/124\"\u003egoogle/osv-scanner-action#124\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tobyhawker\"\u003e\u003ccode\u003e@​tobyhawker\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/124\"\u003egoogle/osv-scanner-action#124\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.3...v2.3.5\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.3...v2.3.5\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.3\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.3.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): update github/codeql-action action to v4.31.10 by \u003ca href=\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e@​renovate-bot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/115\"\u003egoogle/osv-scanner-action#115\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate to v2.3.3 by \u003ca href=\"https://github.com/Ly-Joey\"\u003e\u003ccode\u003e@​Ly-Joey\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/118\"\u003egoogle/osv-scanner-action#118\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Ly-Joey\"\u003e\u003ccode\u003e@​Ly-Joey\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/pull/118\"\u003egoogle/osv-scanner-action#118\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.2...v2.3.3\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.2...v2.3.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.3.2\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.2\u003c/p\u003e\n\u003cp\u003eThis release includes performance improvements for local scanning, reducing memory usage and avoiding unnecessary advisory loading. It also fixes issues with MCP's get_vulnerability_details tool, git queries in \u003ccode\u003eosv-scanner.json\u003c/code\u003e, and ignore entry tracking, along with documentation updates.\u003c/p\u003e\n\u003ch3\u003eFixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2415\"\u003e#2415\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2415\"\u003egoogle/osv-scanner#2415\u003c/a\u003e) Add more PURL-to-ecosystem mappings\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2422\"\u003e#2422\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2422\"\u003egoogle/osv-scanner#2422\u003c/a\u003e) MCP error for get_vulnerability_id because type definition is incorrect.\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2460\"\u003e#2460\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2460\"\u003egoogle/osv-scanner#2460\u003c/a\u003e) Enable osv-scanner.json git queries\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2456\"\u003e#2456\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2456\"\u003egoogle/osv-scanner#2456\u003c/a\u003e) Properly track if an ignore entry has been used\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2450\"\u003e#2450\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2450\"\u003egoogle/osv-scanner#2450\u003c/a\u003e) \u003cstrong\u003ePerformance:\u003c/strong\u003e Avoid loading the entire advisory unless it will actually be used\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2445\"\u003e#2445\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2445\"\u003egoogle/osv-scanner#2445\u003c/a\u003e) \u003cstrong\u003ePerformance:\u003c/strong\u003e Don't read the entire zip into memory\u003c/li\u003e\n\u003cli\u003e[Bug \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2433\"\u003e#2433\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2433\"\u003egoogle/osv-scanner#2433\u003c/a\u003e) Allow specifying user agent in v2 osvscanner package\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMisc:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e[Misc \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2453\"\u003e#2453\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2453\"\u003egoogle/osv-scanner#2453\u003c/a\u003e) Switch from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3\u003c/li\u003e\n\u003cli\u003e[Misc \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2447\"\u003e#2447\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2447\"\u003egoogle/osv-scanner#2447\u003c/a\u003e) Include \u003ccode\u003ebun.lock\u003c/code\u003e as a supported lockfile\u003c/li\u003e\n\u003cli\u003e[Misc \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/2444\"\u003e#2444\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/google/osv-scanner/pull/2444\"\u003egoogle/osv-scanner#2444\u003c/a\u003e) Document GoVersionOverride in configuration.md\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9517144e5504957104c831530fe605bfdc71f353\"\u003e\u003ccode\u003e9517144\u003c/code\u003e\u003c/a\u003e feat: output results in reusable workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f17cd09224d6ef8be953fb49371e6bffb2dbf44a\"\u003e\u003ccode\u003ef17cd09\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into main\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v1.9.1...v2.3.8\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google/osv-scanner-action\u0026package-manager=github_actions\u0026previous-version=1.9.1\u0026new-version=2.3.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/Jobways03/SPORTSMART_OFFICIAL_MM/pull/11","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/Jobways03%2FSPORTSMART_OFFICIAL_MM/issues/11","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/11/packages"}},{"old_version":"2.3.5","new_version":"2.3.8","update_type":"patch","path":null,"pr_created_at":"2026-05-17T03:24:18.000Z","version_change":"2.3.5 → 2.3.8","issue":{"uuid":"4462140509","node_id":"PR_kwDORHJBrs7cUAaV","number":74,"state":"closed","title":"chore(gha)(deps): bump the github-actions-minor-and-patch group with 3 updates","user":"dependabot[bot]","labels":["dependencies","github_actions"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":"2026-05-17T03:25:23.000Z","author_association":null,"state_reason":null,"created_at":"2026-05-17T03:24:18.000Z","updated_at":"2026-05-17T03:25:24.000Z","time_to_close":65,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(gha)(deps): bump","group_name":"github-actions-minor-and-patch","update_count":3,"packages":[{"name":"step-security/harden-runner","old_version":"2.19.1","new_version":"2.19.3","repository_url":"https://github.com/step-security/harden-runner"},{"name":"github/codeql-action","old_version":"4.35.4","new_version":"4.35.5","repository_url":"https://github.com/github/codeql-action"},{"name":"google/osv-scanner-action","old_version":"2.3.5","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions-minor-and-patch group with 3 updates: [step-security/harden-runner](https://github.com/step-security/harden-runner), [github/codeql-action](https://github.com/github/codeql-action) and [google/osv-scanner-action](https://github.com/google/osv-scanner-action).\n\nUpdates `step-security/harden-runner` from 2.19.1 to 2.19.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/step-security/harden-runner/releases\"\u003estep-security/harden-runner's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.19.3\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDefault to audit mode when api-key missing with use-policy-store by \u003ca href=\"https://github.com/varunsh-coder\"\u003e\u003ccode\u003e@​varunsh-coder\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/665\"\u003estep-security/harden-runner#665\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ab7a9404c0f3da075243ca237b5fac12c98deaa5\"\u003e\u003ccode\u003eab7a940\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/665\"\u003e#665\u003c/a\u003e from step-security/fix/use-policy-store-default-audit\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ec41b783c27ed7f0db6855a6d9970abd4572858c\"\u003e\u003ccode\u003eec41b78\u003c/code\u003e\u003c/a\u003e Default to audit mode when api-key missing with use-policy-store\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/9ca718d3bf646d6534007c269a635b3e54cadf99\"\u003e\u003ccode\u003e9ca718d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/664\"\u003e#664\u003c/a\u003e from step-security/update-agent-v1.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/1dee3df8d29f4225c582eee2ddb6053ca616c0df\"\u003e\u003ccode\u003e1dee3df\u003c/code\u003e\u003c/a\u003e Update agent to v1.8.5\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/step-security/harden-runner/compare/a5ad31d6a139d249332a2605b85202e8c0b78450...ab7a9404c0f3da075243ca237b5fac12c98deaa5\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action` from 4.35.4 to 4.35.5\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.35.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal \u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will be enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for GitHub-internal use only, and may change without notice at any time. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning analysis for a PR with \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003ereleases page\u003c/a\u003e for the relevant changes to the CodeQL CLI and language packs.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.5 - 15 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal \u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will be enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for GitHub-internal use only, and may change without notice at any time. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning analysis for a PR with \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.4 - 07 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.3 - 01 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP OIDC are now accepted. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBest-effort connection tests for private registries now use \u003ccode\u003eGET\u003c/code\u003e requests instead of \u003ccode\u003eHEAD\u003c/code\u003e for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3853\"\u003e#3853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3\"\u003e2.25.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3865\"\u003e#3865\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.2 - 15 Apr 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe undocumented TRAP cache cleanup feature that could be enabled using the \u003ccode\u003eCODEQL_ACTION_CLEANUP_TRAP_CACHES\u003c/code\u003e environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the \u003ccode\u003etrap-caching: false\u003c/code\u003e input to the \u003ccode\u003einit\u003c/code\u003e Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3795\"\u003e#3795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3789\"\u003e#3789\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePython analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3794\"\u003e#3794\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3807\"\u003e#3807\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2\"\u003e2.25.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3823\"\u003e#3823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.1 - 27 Mar 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix incorrect minimum required Git version for \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e: it should have been 2.36.0, not 2.11.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3781\"\u003e#3781\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.0 - 27 Mar 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReduced the minimum Git version required for \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e from 2.38.0 to 2.11.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3767\"\u003e#3767\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1\"\u003e2.25.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3773\"\u003e#3773\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.34.1 - 20 Mar 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDowngrade default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3\"\u003e2.24.3\u003c/a\u003e due to issues with a small percentage of Actions and JavaScript analyses. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3762\"\u003e#3762\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.34.0 - 20 Mar 2026\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/9e0d7b8d25671d64c341c19c0152d693099fb5ba\"\u003e\u003ccode\u003e9e0d7b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3905\"\u003e#3905\u003c/a\u003e from github/update-v4.35.5-d4b485515\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6d7d59927c0c7336c1d1247c7e159e79edbf7684\"\u003e\u003ccode\u003e6d7d599\u003c/code\u003e\u003c/a\u003e Add changelog entry for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/51f7e38c69d3cd7966375fe0ffff19669f22bd14\"\u003e\u003ccode\u003e51f7e38\u003c/code\u003e\u003c/a\u003e Update changelog for v4.35.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d4b485515e8531d7071a39d526213eb5b2e74a11\"\u003e\u003ccode\u003ed4b4855\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3899\"\u003e#3899\u003c/a\u003e from github/mbg/esbuild/split\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/127de8117f134e8809c127d53e940b3ffc1db8e9\"\u003e\u003ccode\u003e127de81\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/esbuild/split\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7fde13f26ad3f7008e8fe6755cb997b54f7a2f3b\"\u003e\u003ccode\u003e7fde13f\u003c/code\u003e\u003c/a\u003e Use src + basename in header to avoid issues on Windows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/dfa61e7305ed28b74dcc2c68bd665b36751ad933\"\u003e\u003ccode\u003edfa61e7\u003c/code\u003e\u003c/a\u003e Improve pattern matching and error handling\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/52aafec07347933a26e670390c3f894c5c05e64a\"\u003e\u003ccode\u003e52aafec\u003c/code\u003e\u003c/a\u003e Import and call \u003ccode\u003erunWrapper\u003c/code\u003e normally in \u003ccode\u003eanalyze\u003c/code\u003e tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/0d08c01f7874da2f932e4d4e4d42b1c43be88111\"\u003e\u003ccode\u003e0d08c01\u003c/code\u003e\u003c/a\u003e Auto-generate shared bundle\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/14085a675cb6d8cddc805b946cc1d51e3232a204\"\u003e\u003ccode\u003e14085a6\u003c/code\u003e\u003c/a\u003e Auto-generate entry points\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/68bde559dea0fdcac2102bfdf6230c5f70eb485e...9e0d7b8d25671d64c341c19c0152d693099fb5ba\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action` from 2.3.5 to 2.3.8\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9517144e5504957104c831530fe605bfdc71f353\"\u003e\u003ccode\u003e9517144\u003c/code\u003e\u003c/a\u003e feat: output results in reusable workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f17cd09224d6ef8be953fb49371e6bffb2dbf44a\"\u003e\u003ccode\u003ef17cd09\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into main\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/c51854704019a247608d928f370c98740469d4b5...9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/nathanvale/side-quest-runners/pull/74","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/nathanvale%2Fside-quest-runners/issues/74","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/74/packages"}},{"old_version":"2.3.5","new_version":"2.3.8","update_type":"patch","path":null,"pr_created_at":"2026-05-16T02:33:17.000Z","version_change":"2.3.5 → 2.3.8","issue":{"uuid":"4458223145","node_id":"PR_kwDOSe3Vr87cIa2L","number":1,"state":"closed","title":"chore(deps): bump the github-actions group with 9 updates","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":"2026-05-23T00:28:01.000Z","author_association":null,"state_reason":null,"created_at":"2026-05-16T02:33:17.000Z","updated_at":"2026-05-23T00:28:02.000Z","time_to_close":597284,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"github-actions","update_count":9,"packages":[{"name":"actions/checkout","old_version":"3.1.0","new_version":"6.0.2","repository_url":"https://github.com/actions/checkout"},{"name":"step-security/harden-runner","old_version":"2.19.0","new_version":"2.19.3","repository_url":"https://github.com/step-security/harden-runner"},{"name":"github/codeql-action","old_version":"2.1.36","new_version":"4.35.5","repository_url":"https://github.com/github/codeql-action"},{"name":"actions/dependency-review-action","old_version":"4.9.0","new_version":"5.0.0","repository_url":"https://github.com/actions/dependency-review-action"},{"name":"actions/labeler","old_version":"6.0.1","new_version":"6.1.0","repository_url":"https://github.com/actions/labeler"},{"name":"google/osv-scanner-action","old_version":"2.3.5","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"},{"name":"release-drafter/release-drafter","old_version":"7.2.1","new_version":"7.3.0","repository_url":"https://github.com/release-drafter/release-drafter"},{"name":"sigstore/cosign-installer","old_version":"4.1.1","new_version":"4.1.2","repository_url":"https://github.com/sigstore/cosign-installer"},{"name":"crate-ci/typos","old_version":"1.45.2","new_version":"1.46.1","repository_url":"https://github.com/crate-ci/typos"}],"path":null,"ecosystem":"actions"},"body":"Bumps the github-actions group with 9 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/checkout](https://github.com/actions/checkout) | `3.1.0` | `6.0.2` |\n| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.19.0` | `2.19.3` |\n| [github/codeql-action](https://github.com/github/codeql-action) | `2.1.36` | `4.35.5` |\n| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.9.0` | `5.0.0` |\n| [actions/labeler](https://github.com/actions/labeler) | `6.0.1` | `6.1.0` |\n| [google/osv-scanner-action](https://github.com/google/osv-scanner-action) | `2.3.5` | `2.3.8` |\n| [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) | `7.2.1` | `7.3.0` |\n| [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `4.1.1` | `4.1.2` |\n| [crate-ci/typos](https://github.com/crate-ci/typos) | `1.45.2` | `1.46.1` |\n\nUpdates `actions/checkout` from 3.1.0 to 6.0.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/releases\"\u003eactions/checkout's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by \u003ca href=\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2355\"\u003eactions/checkout#2355\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6.0.1...v6.0.2\"\u003ehttps://github.com/actions/checkout/compare/v6.0.1...v6.0.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all references from v5 and v4 to v6 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2314\"\u003eactions/checkout#2314\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eClarify v6 README by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2328\"\u003eactions/checkout#2328\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v6...v6.0.1\"\u003ehttps://github.com/actions/checkout/compare/v6...v6.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ev6-beta by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2298\"\u003eactions/checkout#2298\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate readme/changelog for v6 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2311\"\u003eactions/checkout#2311\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v5.0.0...v6.0.0\"\u003ehttps://github.com/actions/checkout/compare/v5.0.0...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6-beta\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eUpdated persist-credentials to store the credentials under \u003ccode\u003e$RUNNER_TEMP\u003c/code\u003e instead of directly in the local git config.\u003c/p\u003e\n\u003cp\u003eThis requires a minimum Actions Runner version of \u003ca href=\"https://github.com/actions/runner/releases/tag/v2.329.0\"\u003ev2.329.0\u003c/a\u003e to access the persisted credentials for \u003ca href=\"https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action\"\u003eDocker container action\u003c/a\u003e scenarios.\u003c/p\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/checkout/compare/v5...v5.0.1\"\u003ehttps://github.com/actions/checkout/compare/v5...v5.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare v5.0.0 release by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2238\"\u003eactions/checkout#2238\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e⚠️ Minimum Compatible Runner Version\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003ev2.327.1\u003c/strong\u003e\u003cbr /\u003e\n\u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003eRelease Notes\u003c/a\u003e\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\"\u003eactions/checkout's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v4 by \u003ca href=\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2305\"\u003eactions/checkout#2305\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update README.md by \u003ca href=\"https://github.com/motss\"\u003e\u003ccode\u003e@​motss\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1971\"\u003eactions/checkout#1971\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd internal repos for checking out multiple repositories by \u003ca href=\"https://github.com/mouismail\"\u003e\u003ccode\u003e@​mouismail\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1977\"\u003eactions/checkout#1977\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation update - add recommended permissions to Readme by \u003ca href=\"https://github.com/benwells\"\u003e\u003ccode\u003e@​benwells\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2043\"\u003eactions/checkout#2043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdjust positioning of user email note and permissions heading by \u003ca href=\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2044\"\u003eactions/checkout#2044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca href=\"https://github.com/nebuk89\"\u003e\u003ccode\u003e@​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2194\"\u003eactions/checkout#2194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate CODEOWNERS for actions by \u003ca href=\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2224\"\u003eactions/checkout#2224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate package dependencies by \u003ca href=\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/2236\"\u003eactions/checkout#2236\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eurl-helper.ts\u003c/code\u003e now leverages well-known environment variables by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1941\"\u003eactions/checkout#1941\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpand unit test coverage for \u003ccode\u003eisGhes\u003c/code\u003e by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1946\"\u003eactions/checkout#1946\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck out other refs/* by commit if provided, fall back to ref by \u003ca href=\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1924\"\u003eactions/checkout#1924\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd Ref and Commit outputs by \u003ca href=\"https://github.com/lucacome\"\u003e\u003ccode\u003e@​lucacome\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1180\"\u003eactions/checkout#1180\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDependency updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e- \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1777\"\u003eactions/checkout#1777\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1872\"\u003eactions/checkout#1872\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.1.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1739\"\u003eactions/checkout#1739\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 3 to 4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1697\"\u003eactions/checkout#1697\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCheck out other refs/* by commit by \u003ca href=\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1774\"\u003eactions/checkout#1774\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin actions/checkout's own workflows to a known, good, stable version. by \u003ca href=\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1776\"\u003eactions/checkout#1776\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.1.6\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck platform to set archive extension appropriately by \u003ca href=\"https://github.com/cory-miller\"\u003e\u003ccode\u003e@​cory-miller\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/checkout/pull/1732\"\u003eactions/checkout#1732\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/de0fac2e4500dabe0009e67214ff5f5447ce83dd\"\u003e\u003ccode\u003ede0fac2\u003c/code\u003e\u003c/a\u003e Fix tag handling: preserve annotations and explicit fetch-tags (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2356\"\u003e#2356\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/064fe7f3312418007dea2b49a19844a9ee378f49\"\u003e\u003ccode\u003e064fe7f\u003c/code\u003e\u003c/a\u003e Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/8e8c483db84b4bee98b60c0593521ed34d9990e8\"\u003e\u003ccode\u003e8e8c483\u003c/code\u003e\u003c/a\u003e Clarify v6 README (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2328\"\u003e#2328\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/033fa0dc0b82693d8986f1016a0ec2c5e7d9cbb1\"\u003e\u003ccode\u003e033fa0d\u003c/code\u003e\u003c/a\u003e Add worktree support for persist-credentials includeIf (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2327\"\u003e#2327\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5\"\u003e\u003ccode\u003ec2d88d3\u003c/code\u003e\u003c/a\u003e Update all references from v5 and v4 to v6 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2314\"\u003e#2314\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3\"\u003e\u003ccode\u003e1af3b93\u003c/code\u003e\u003c/a\u003e update readme/changelog for v6 (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2311\"\u003e#2311\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/71cf2267d89c5cb81562390fa70a37fa40b1305e\"\u003e\u003ccode\u003e71cf226\u003c/code\u003e\u003c/a\u003e v6-beta (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2298\"\u003e#2298\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/069c6959146423d11cd0184e6accf28f9d45f06e\"\u003e\u003ccode\u003e069c695\u003c/code\u003e\u003c/a\u003e Persist creds to a separate file (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2286\"\u003e#2286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493\"\u003e\u003ccode\u003eff7abcd\u003c/code\u003e\u003c/a\u003e Update README to include Node.js 24 support details and requirements (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2248\"\u003e#2248\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/checkout/commit/08c6903cd8c0fde910a37f88322edcfb5dd907a8\"\u003e\u003ccode\u003e08c6903\u003c/code\u003e\u003c/a\u003e Prepare v5.0.0 release (\u003ca href=\"https://redirect.github.com/actions/checkout/issues/2238\"\u003e#2238\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/checkout/compare/v3.1.0...de0fac2e4500dabe0009e67214ff5f5447ce83dd\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `step-security/harden-runner` from 2.19.0 to 2.19.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/step-security/harden-runner/releases\"\u003estep-security/harden-runner's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.19.3\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDefault to audit mode when api-key missing with use-policy-store by \u003ca href=\"https://github.com/varunsh-coder\"\u003e\u003ccode\u003e@​varunsh-coder\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/665\"\u003estep-security/harden-runner#665\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.19.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: detect ubuntu-slim runners early and bail out by \u003ca href=\"https://github.com/devantler\"\u003e\u003ccode\u003e@​devantler\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/657\"\u003estep-security/harden-runner#657\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eWhat the fix changes\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eHarden-Runner will detect \u003ccode\u003eubuntu-slim\u003c/code\u003e runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eWhat the fix does not do\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eJobs running on \u003ccode\u003eubuntu-slim\u003c/code\u003e will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).\u003c/li\u003e\n\u003cli\u003ePer GitHub's docs on \u003ca href=\"https://docs.github.com/en/actions/reference/runners/github-hosted-runners#single-cpu-runners\"\u003esingle-CPU runners\u003c/a\u003e: \u0026quot;The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported.\u0026quot;  Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eFor StepSecurity enterprise customers\nIf your security posture requires that workflows are always monitored, you can block the use of \u003ccode\u003eubuntu-slim\u003c/code\u003e via workflow run policies see the \u003ca href=\"https://docs.stepsecurity.io/workflow-run-policies/policies#runner-label-policy\"\u003eRunner Label Policy\u003c/a\u003e docs. This lets you enforce that jobs only run on monitored runner types.\u003c/p\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/devantler\"\u003e\u003ccode\u003e@​devantler\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/step-security/harden-runner/pull/657\"\u003estep-security/harden-runner#657\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1\"\u003ehttps://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ab7a9404c0f3da075243ca237b5fac12c98deaa5\"\u003e\u003ccode\u003eab7a940\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/665\"\u003e#665\u003c/a\u003e from step-security/fix/use-policy-store-default-audit\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/ec41b783c27ed7f0db6855a6d9970abd4572858c\"\u003e\u003ccode\u003eec41b78\u003c/code\u003e\u003c/a\u003e Default to audit mode when api-key missing with use-policy-store\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/9ca718d3bf646d6534007c269a635b3e54cadf99\"\u003e\u003ccode\u003e9ca718d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/664\"\u003e#664\u003c/a\u003e from step-security/update-agent-v1.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/1dee3df8d29f4225c582eee2ddb6053ca616c0df\"\u003e\u003ccode\u003e1dee3df\u003c/code\u003e\u003c/a\u003e Update agent to v1.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/a5ad31d6a139d249332a2605b85202e8c0b78450\"\u003e\u003ccode\u003ea5ad31d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/step-security/harden-runner/issues/657\"\u003e#657\u003c/a\u003e from devantler/fix/ubuntu-slim-user-env\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/6e928567d74554b8842dd434908da31c593ba85c\"\u003e\u003ccode\u003e6e92856\u003c/code\u003e\u003c/a\u003e build dist and trim ubuntu-slim message\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/4e0504ee086374bdec7064e5c26d48af41ba6209\"\u003e\u003ccode\u003e4e0504e\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into fix/ubuntu-slim-user-env\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/step-security/harden-runner/commit/376d25a97f3a1640ff8cbbddaa4af25948df2cf3\"\u003e\u003ccode\u003e376d25a\u003c/code\u003e\u003c/a\u003e fix: detect ubuntu-slim runners early and bail out\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/step-security/harden-runner/compare/8d3c67de8e2fe68ef647c8db1e6a09f647780f40...ab7a9404c0f3da075243ca237b5fac12c98deaa5\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action` from 2.1.36 to 4.35.5\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.35.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal \u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will be enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for GitHub-internal use only, and may change without notice at any time. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning analysis for a PR with \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP OIDC are now accepted. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBest-effort connection tests for private registries now use \u003ccode\u003eGET\u003c/code\u003e requests instead of \u003ccode\u003eHEAD\u003c/code\u003e for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3853\"\u003e#3853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3\"\u003e2.25.3\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3865\"\u003e#3865\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe undocumented TRAP cache cleanup feature that could be enabled using the \u003ccode\u003eCODEQL_ACTION_CLEANUP_TRAP_CACHES\u003c/code\u003e environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the \u003ccode\u003etrap-caching: false\u003c/code\u003e input to the \u003ccode\u003einit\u003c/code\u003e Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3795\"\u003e#3795\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eThe Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3789\"\u003e#3789\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePython analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3794\"\u003e#3794\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3807\"\u003e#3807\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2\"\u003e2.25.2\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3823\"\u003e#3823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix incorrect minimum required Git version for \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e: it should have been 2.36.0, not 2.11.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3781\"\u003e#3781\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.35.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReduced the minimum Git version required for \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e from 2.38.0 to 2.11.0. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3767\"\u003e#3767\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1\"\u003e2.25.1\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3773\"\u003e#3773\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.34.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDowngrade default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3\"\u003e2.24.3\u003c/a\u003e due to issues with a small percentage of Actions and JavaScript analyses. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3762\"\u003e#3762\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.34.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded an experimental change which disables TRAP caching when \u003ca href=\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved incremental analysis\u003c/a\u003e is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3569\"\u003e#3569\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eWe are rolling out improved incremental analysis to C/C++ analyses that use build mode \u003ccode\u003enone\u003c/code\u003e. We expect this rollout to be complete by the end of April 2026. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3584\"\u003e#3584\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca href=\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0\"\u003e2.25.0\u003c/a\u003e. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3585\"\u003e#3585\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.33.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3562\"\u003e#3562\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eTo opt out of this change:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eRepositories owned by an organization:\u003c/strong\u003e Create a custom repository property with the name \u003ccode\u003egithub-codeql-file-coverage-on-prs\u003c/code\u003e and the type \u0026quot;True/false\u0026quot;, then set this property to \u003ccode\u003etrue\u003c/code\u003e in the repository's settings. For more information, see \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003eManaging custom properties for repositories in your organization\u003c/a\u003e. Alternatively, if you are using an advanced setup workflow, you can set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUser-owned repositories using default setup:\u003c/strong\u003e Switch to an advanced setup workflow and set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUser-owned repositories using advanced setup:\u003c/strong\u003e Set the \u003ccode\u003eCODEQL_ACTION_FILE_COVERAGE_ON_PRS\u003c/code\u003e environment variable to \u003ccode\u003etrue\u003c/code\u003e in your workflow.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3555\"\u003ea bug\u003c/a\u003e which caused the CodeQL Action to fail loading repository properties if a \u0026quot;Multi select\u0026quot; repository property was configured for the repository. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3557\"\u003e#3557\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe CodeQL Action now loads \u003ca href=\"https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization\"\u003ecustom repository properties\u003c/a\u003e on GitHub Enterprise Server, enabling the customization of features such as \u003ccode\u003egithub-codeql-disable-overlay\u003c/code\u003e that was previously only available on GitHub.com. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3559\"\u003e#3559\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eOnce \u003ca href=\"https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries\"\u003eprivate package registries\u003c/a\u003e can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3563\"\u003e#3563\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed the retry mechanism for database uploads. Previously this would fail with the error \u0026quot;Response body object should not be disturbed or locked\u0026quot;. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3564\"\u003e#3564\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eA warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. \u003ca href=\"https://redirect.github.com/github/codeql-action/pull/3570\"\u003e#3570\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/9e0d7b8d25671d64c341c19c0152d693099fb5ba\"\u003e\u003ccode\u003e9e0d7b8\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3905\"\u003e#3905\u003c/a\u003e from github/update-v4.35.5-d4b485515\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/6d7d59927c0c7336c1d1247c7e159e79edbf7684\"\u003e\u003ccode\u003e6d7d599\u003c/code\u003e\u003c/a\u003e Add changelog entry for \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/51f7e38c69d3cd7966375fe0ffff19669f22bd14\"\u003e\u003ccode\u003e51f7e38\u003c/code\u003e\u003c/a\u003e Update changelog for v4.35.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/d4b485515e8531d7071a39d526213eb5b2e74a11\"\u003e\u003ccode\u003ed4b4855\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/github/codeql-action/issues/3899\"\u003e#3899\u003c/a\u003e from github/mbg/esbuild/split\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/127de8117f134e8809c127d53e940b3ffc1db8e9\"\u003e\u003ccode\u003e127de81\u003c/code\u003e\u003c/a\u003e Merge remote-tracking branch 'origin/main' into mbg/esbuild/split\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/7fde13f26ad3f7008e8fe6755cb997b54f7a2f3b\"\u003e\u003ccode\u003e7fde13f\u003c/code\u003e\u003c/a\u003e Use src + basename in header to avoid issues on Windows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/dfa61e7305ed28b74dcc2c68bd665b36751ad933\"\u003e\u003ccode\u003edfa61e7\u003c/code\u003e\u003c/a\u003e Improve pattern matching and error handling\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/52aafec07347933a26e670390c3f894c5c05e64a\"\u003e\u003ccode\u003e52aafec\u003c/code\u003e\u003c/a\u003e Import and call \u003ccode\u003erunWrapper\u003c/code\u003e normally in \u003ccode\u003eanalyze\u003c/code\u003e tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/0d08c01f7874da2f932e4d4e4d42b1c43be88111\"\u003e\u003ccode\u003e0d08c01\u003c/code\u003e\u003c/a\u003e Auto-generate shared bundle\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/github/codeql-action/commit/14085a675cb6d8cddc805b946cc1d51e3232a204\"\u003e\u003ccode\u003e14085a6\u003c/code\u003e\u003c/a\u003e Auto-generate entry points\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/github/codeql-action/compare/v2.1.36...v4.35.5\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/dependency-review-action` from 4.9.0 to 5.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/dependency-review-action/releases\"\u003eactions/dependency-review-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e5.0.0\u003c/h2\u003e\n\u003cp\u003eThis is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version \u003ca href=\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003ev2.327.1\u003c/a\u003e to run.\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd .github/copilot-instructions.md for Copilot coding agent by \u003ca href=\"https://github.com/ahpook\"\u003e\u003ccode\u003e@​ahpook\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1067\"\u003eactions/dependency-review-action#1067\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate Node.js runtime from 20 to 24 by \u003ca href=\"https://github.com/scottschreckengaust\"\u003e\u003ccode\u003e@​scottschreckengaust\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1084\"\u003eactions/dependency-review-action#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump spdx-license-ids from 3.0.20 to 3.0.23 by \u003ca href=\"https://github.com/mongolyy\"\u003e\u003ccode\u003e@​mongolyy\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1091\"\u003eactions/dependency-review-action#1091\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: bump actions/checkout from v4 to v6 in workflow examples by \u003ca href=\"https://github.com/Marukome0743\"\u003e\u003ccode\u003e@​Marukome0743\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1077\"\u003eactions/dependency-review-action#1077\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: patched version display for advisories with non-strict semver ranges (e.g. Maven beta versions) by \u003ca href=\"https://github.com/tspascoal\"\u003e\u003ccode\u003e@​tspascoal\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1076\"\u003eactions/dependency-review-action#1076\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolve security findings by \u003ca href=\"https://github.com/AshelyTC\"\u003e\u003ccode\u003e@​AshelyTC\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1094\"\u003eactions/dependency-review-action#1094\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ev5.0.0 release branch by \u003ca href=\"https://github.com/ahpook\"\u003e\u003ccode\u003e@​ahpook\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1098\"\u003eactions/dependency-review-action#1098\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scottschreckengaust\"\u003e\u003ccode\u003e@​scottschreckengaust\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1084\"\u003eactions/dependency-review-action#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mongolyy\"\u003e\u003ccode\u003e@​mongolyy\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1091\"\u003eactions/dependency-review-action#1091\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Marukome0743\"\u003e\u003ccode\u003e@​Marukome0743\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/pull/1077\"\u003eactions/dependency-review-action#1077\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/dependency-review-action/compare/v4.9.0...v5.0.0\"\u003ehttps://github.com/actions/dependency-review-action/compare/v4.9.0...v5.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/a1d282b36b6f3519aa1f3fc636f609c47dddb294\"\u003e\u003ccode\u003ea1d282b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1098\"\u003e#1098\u003c/a\u003e from actions/ahpook/v5-release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/eb6c199c5a85c7387f1f0b02b3ba5c6364740695\"\u003e\u003ccode\u003eeb6c199\u003c/code\u003e\u003c/a\u003e update examples to show \u003ca href=\"https://github.com/v5\"\u003e\u003ccode\u003e@​v5\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/3943c2c5beaaaf1806eb3758273c203dabcbf89c\"\u003e\u003ccode\u003e3943c2c\u003c/code\u003e\u003c/a\u003e v5.0.0 release branch\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/454943c880b147adbfe7de0cdd3ece1c00882033\"\u003e\u003ccode\u003e454943c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1094\"\u003e#1094\u003c/a\u003e from actions/ashelytc/security-findings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/6d92a1228e9e9db334f02c09f84fe9217d2b4463\"\u003e\u003ccode\u003e6d92a12\u003c/code\u003e\u003c/a\u003e revert \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e update\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/a8e5a7e93695b41abf6d1083cd220bee39a720f0\"\u003e\u003ccode\u003ea8e5a7e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1076\"\u003e#1076\u003c/a\u003e from tspascoal/fix-version-matching-for-non-string-s...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/b6b7079031ef4ed61656c221988f1f3bcbf35101\"\u003e\u003ccode\u003eb6b7079\u003c/code\u003e\u003c/a\u003e update \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e to 8.40.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/821a21dd691f162c4c5c2e9754a344accde9a208\"\u003e\u003ccode\u003e821a21d\u003c/code\u003e\u003c/a\u003e update more dependencies\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/05aaaae45cf4c420de012addf2a72e3435ddaa63\"\u003e\u003ccode\u003e05aaaae\u003c/code\u003e\u003c/a\u003e run npm audit fix\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/dependency-review-action/commit/55d3e754501fc13c84b95637ce51f135012d41ea\"\u003e\u003ccode\u003e55d3e75\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/actions/dependency-review-action/issues/1077\"\u003e#1077\u003c/a\u003e from Marukome0743/docs/checkout\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/actions/dependency-review-action/compare/2031cfc080254a8a887f58cffee85186f0e49e48...a1d282b36b6f3519aa1f3fc636f609c47dddb294\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/labeler` from 6.0.1 to 6.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/actions/labeler/releases\"\u003eactions/labeler's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.1.0\u003c/h2\u003e\n\u003ch2\u003eEnhancements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd changed-files-labels-limit and max-files-changed configuration options to cap the number of labels added by \u003ca href=\"https://github.com/bluca\"\u003e\u003ccode\u003e@​bluca\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/923\"\u003eactions/labeler#923\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImprove Labeler Action documentation and permission error handling by \u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/897\"\u003eactions/labeler#897\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePreserve manually added labels during workflow runs and refine label synchronization logic by \u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/917\"\u003eactions/labeler#917\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDependency Updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v6 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/877\"\u003eactions/labeler#877\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade minimatch from 10.0.1 to 10.2.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/926\"\u003eactions/labeler#926\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade dependencies (\u003ccode\u003e@​actions/core\u003c/code\u003e, \u003ccode\u003e@​actions/github\u003c/code\u003e, js-yaml, minimatch, \u003ca href=\"https://github.com/typescript-eslint\"\u003e\u003ccode\u003e@​typescript-eslint\u003c/code\u003e\u003c/a\u003e) by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/934\"\u003eactions/labeler#934\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e@​chiranjib-swain\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/897\"\u003eactions/labeler#897\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/bluca\"\u003e\u003ccode\u003e@​bluca\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/923\"\u003eactions/labeler#923\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/actions/labeler/pull/934\"\u003eactions/labeler#934\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/actions/labeler/compare/v6...v6.1.0\"\u003ehttps://github.com/actions/labeler/compare/v6...v6.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/f27b608878404679385c85cfa523b85ccb86e213\"\u003e\u003ccode\u003ef27b608\u003c/code\u003e\u003c/a\u003e chore: upgrade dependencies (\u003ccode\u003e@​actions/core\u003c/code\u003e, \u003ccode\u003e@​actions/github\u003c/code\u003e, js-yaml, minimat...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/c5dadc2a45784a4b6adfcd20fea3465da3a5f904\"\u003e\u003ccode\u003ec5dadc2\u003c/code\u003e\u003c/a\u003e Add 'changed-files-labels-limit' and 'max-files-changed' configs to allow cap...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/e52e4fb63ed5cd0e07abaad9826b2a893ccb921f\"\u003e\u003ccode\u003ee52e4fb\u003c/code\u003e\u003c/a\u003e Bump minimatch from 10.0.1 to 10.2.3 (\u003ca href=\"https://redirect.github.com/actions/labeler/issues/926\"\u003e#926\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/77a4082b841706ac431479b7e2bb11216ffef250\"\u003e\u003ccode\u003e77a4082\u003c/code\u003e\u003c/a\u003e Fix: Preserve manually added labels during workflow run and refine label sync...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/25abb3cad4f14b7ac27968a495c37798860a5a1a\"\u003e\u003ccode\u003e25abb3c\u003c/code\u003e\u003c/a\u003e Improve Labeler Action Documentation and Error Handling for Permissions (\u003ca href=\"https://redirect.github.com/actions/labeler/issues/897\"\u003e#897\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/actions/labeler/commit/395c8cfdb1e1e691cc4bad0dd315820af8eb67fd\"\u003e\u003ccode\u003e395c8cf\u003c/code\u003e\u003c/a\u003e Bump brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v...\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/actions/labeler/compare/634933edcd8ababfe52f92936142cc22ac488b1b...f27b608878404679385c85cfa523b85ccb86e213\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google/osv-scanner-action` from 2.3.5 to 2.3.8\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9517144e5504957104c831530fe605bfdc71f353\"\u003e\u003ccode\u003e9517144\u003c/code\u003e\u003c/a\u003e feat: output results in reusable workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f17cd09224d6ef8be953fb49371e6bffb2dbf44a\"\u003e\u003ccode\u003ef17cd09\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into main\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/c51854704019a247608d928f370c98740469d4b5...9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `release-drafter/release-drafter` from 7.2.1 to 7.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/release-drafter/release-drafter/releases\"\u003erelease-drafter/release-drafter's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.3.0\u003c/h2\u003e\n\u003ch1\u003eWhat's Changed\u003c/h1\u003e\n\u003ch2\u003eNew\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: recover recently merged PRs missed by associated PRs lag (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1604\"\u003e#1604\u003c/a\u003e) \u003ca href=\"https://github.com/jetersen\"\u003e\u003ccode\u003e@​jetersen\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: switch release discovery to ref comparison and explicit missing-baseline warnings (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1570\"\u003e#1570\u003c/a\u003e) \u003ca href=\"https://github.com/jetersen\"\u003e\u003ccode\u003e@​jetersen\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: restore prerelease-identifier on first run when no prior releases exist (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1602\"\u003e#1602\u003c/a\u003e) \u003ca href=\"https://github.com/jrbeilke\"\u003e\u003ccode\u003e@​jrbeilke\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: prevent using commitish like refs/pull (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1598\"\u003e#1598\u003c/a\u003e) \u003ca href=\"https://github.com/cchanche\"\u003e\u003ccode\u003e@​cchanche\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eMaintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eci: rebuild dist after codegen so generated PRs include bundle updates (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1605\"\u003e#1605\u003c/a\u003e) \u003ca href=\"https://github.com/jetersen\"\u003e\u003ccode\u003e@​jetersen\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: update generated GraphQL types (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1600\"\u003e#1600\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: clarify base repository pr filtering (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1599\"\u003e#1599\u003c/a\u003e) \u003ca href=\"https://github.com/cchanche\"\u003e\u003ccode\u003e@​cchanche\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDependency Updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps-dev): bump postcss from 8.5.8 to 8.5.12 (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1597\"\u003e#1597\u003c/a\u003e) @\u003ca href=\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/release-drafter/release-drafter/compare/v7.2.1...v7.3.0\"\u003ehttps://github.com/release-drafter/release-drafter/compare/v7.2.1...v7.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/c2e2804cc59f45f57076a99af580d0fedb697927\"\u003e\u003ccode\u003ec2e2804\u003c/code\u003e\u003c/a\u003e chore: release v7.3.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/0c28acd0bcb335f1f86b350a4283045eb03025b9\"\u003e\u003ccode\u003e0c28acd\u003c/code\u003e\u003c/a\u003e feat: recover recently merged PRs missed by associated PRs lag (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1604\"\u003e#1604\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/3052ee00309feb828889940f8ea4fb642ff57f4e\"\u003e\u003ccode\u003e3052ee0\u003c/code\u003e\u003c/a\u003e fix: restore prerelease-identifier on first run when no prior releases exist ...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/0503d11169c6098c4ff53bb412ae8887b6fbb79c\"\u003e\u003ccode\u003e0503d11\u003c/code\u003e\u003c/a\u003e ci: rebuild dist after codegen so generated PRs include bundle updates (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1605\"\u003e#1605\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/a553731db26761b6a6446a23e3a978949cba6e2b\"\u003e\u003ccode\u003ea553731\u003c/code\u003e\u003c/a\u003e chore: update generated GraphQL types (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1600\"\u003e#1600\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/c5dd36151c0584427a1f10cb41d5ba73cebcdad4\"\u003e\u003ccode\u003ec5dd361\u003c/code\u003e\u003c/a\u003e ci: add warning on automatic codegen PRs\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/705c5afff81196e065284562dd78729d4bbdab7a\"\u003e\u003ccode\u003e705c5af\u003c/code\u003e\u003c/a\u003e ci: add maintenance label to automated codegen updates\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/acfaf4fa10f83604f93febbc544d5be415f0458e\"\u003e\u003ccode\u003eacfaf4f\u003c/code\u003e\u003c/a\u003e chore: clarify base repository pr filtering (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1599\"\u003e#1599\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/d181a5a9df5268ebc5c1cdebeaef584ddbe14412\"\u003e\u003ccode\u003ed181a5a\u003c/code\u003e\u003c/a\u003e fix: prevent using commitish like refs/pull (\u003ca href=\"https://redirect.github.com/release-drafter/release-drafter/issues/1598\"\u003e#1598\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/release-drafter/release-drafter/commit/f188d08e9e71d8903f02ca1c5e7aea645a815537\"\u003e\u003ccode\u003ef188d08\u003c/code\u003e\u003c/a\u003e feat: switch release discovery to ref comparison and explicit missing-baselin...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/release-drafter/release-drafter/compare/563bf132657a13ded0b01fcb723c5a58cdd824e2...c2e2804cc59f45f57076a99af580d0fedb697927\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `sigstore/cosign-installer` from 4.1.1 to 4.1.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/sigstore/cosign-installer/releases\"\u003esigstore/cosign-installer's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.1.2\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump cosign to 3.0.6 in \u003ca href=\"https://redirect.github.com/sigstore/cosign-installer/pull/232\"\u003esigstore/cosign-installer#232\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sigstore/cosign-installer/commit/6f9f17788090df1f26f669e9d70d6ae9567deba6\"\u003e\u003ccode\u003e6f9f177\u003c/code\u003e\u003c/a\u003e Bump cosign to 3.0.6 (\u003ca href=\"https://redirect.github.com/sigstore/cosign-installer/issues/232\"\u003e#232\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sigstore/cosign-installer/commit/b5e753ae2d39589c7b38850b463739151fc67f07\"\u003e\u003ccode\u003eb5e753a\u003c/code\u003e\u003c/a\u003e Bump actions/github-script from 8.0.0 to 9.0.0 (\u003ca href=\"https://redirect.github.com/sigstore/cosign-installer/issues/230\"\u003e#230\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sigstore/cosign-installer/commit/115e4ce455e573aa6e9ba51e8d040ddd5c1378af\"\u003e\u003ccode\u003e115e4ce\u003c/code\u003e\u003c/a\u003e Bump actions/setup-go from 6.3.0 to 6.4.0 (\u003ca href=\"https://redirect.github.com/sigstore/cosign-installer/issues/226\"\u003e#226\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/sigstore/cosign-installer/compare/cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003...6f9f17788090df1f26f669e9d70d6ae9567deba6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `crate-ci/typos` from 1.45.2 to 1.46.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/crate-ci/typos/releases\"\u003ecrate-ci/typos's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.46.1\u003c/h2\u003e\n\u003ch2\u003e[1.46.1] - 2026-05-08\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003econfidentials\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.46.0\u003c/h2\u003e\n\u003ch2\u003e[1.46.0] - 2026-04-30\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated the dictionary with the \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1531\"\u003eApril 2026\u003c/a\u003e changes\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/crate-ci/typos/blob/master/CHANGELOG.md\"\u003ecrate-ci/typos's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChange Log\u003c/h1\u003e\n\u003cp\u003eAll notable changes to this project will be documented in this file.\u003c/p\u003e\n\u003cp\u003eThe format is based on \u003ca href=\"https://keepachangelog.com/\"\u003eKeep a Changelog\u003c/a\u003e\nand this project adheres to \u003ca href=\"https://semver.org/\"\u003eSemantic Versioning\u003c/a\u003e.\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003e[Unreleased] - ReleaseDate\u003c/h2\u003e\n\u003ch2\u003e[1.46.1] - 2026-05-08\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDon't correct to \u003ccode\u003econfidentials\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.46.0] - 2026-04-30\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated the dictionary with the \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1531\"\u003eApril 2026\u003c/a\u003e changes\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.45.2] - 2026-04-27\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eIgnore ssh ed25519 public keys\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.45.1] - 2026-04-13\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003e(action)\u003c/em\u003e Use a temp dir for caching\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.45.0] - 2026-04-01\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated the dictionary with the \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1509\"\u003eMarch 2026\u003c/a\u003e changes\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.44.0] - 2026-02-27\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated the dictionary with the \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1488\"\u003eFebruary 2026\u003c/a\u003e changes\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.43.5] - 2026-02-16\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003e(pypi)\u003c/em\u003e Hopefully fix the sdist build\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/5374cbf686e897b15713110e233094e2874de7ef\"\u003e\u003ccode\u003e5374cbf\u003c/code\u003e\u003c/a\u003e chore: Release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/52448f5ecf85209e284e8db1c77dd4885885068a\"\u003e\u003ccode\u003e52448f5\u003c/code\u003e\u003c/a\u003e docs: Update changelog\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/030c719ff1afe2ff0f85b84d4f99b7a9a57c3b29\"\u003e\u003ccode\u003e030c719\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1552\"\u003e#1552\u003c/a\u003e from epage/fixes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/7a688c7c08aaa1aa67686848eac4cdd7cb3bb1d2\"\u003e\u003ccode\u003e7a688c7\u003c/code\u003e\u003c/a\u003e fix(dict): Confidentials isn't valid\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/3bcd3b343e2ffaa3d23f8cfe7f78d0f8c2d0d0c6\"\u003e\u003ccode\u003e3bcd3b3\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1548\"\u003e#1548\u003c/a\u003e from crate-ci/renovate/maturin-1.x\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/52940116a3ef7d561b8e27ca5b90db8c8c73b2b5\"\u003e\u003ccode\u003e5294011\u003c/code\u003e\u003c/a\u003e chore(deps): Update compatible (\u003ca href=\"https://redirect.github.com/crate-ci/typos/issues/1547\"\u003e#1547\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/c3be3602c76061246a93c9510f5a197dfd4d0552\"\u003e\u003ccode\u003ec3be360\u003c/code\u003e\u003c/a\u003e chore(deps): Update dependency maturin to \u0026gt;=1.13,\u0026lt;1.14\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/bbaefadf97b0ec5fdc942684b647f1a6ab250274\"\u003e\u003ccode\u003ebbaefad\u003c/code\u003e\u003c/a\u003e chore: Release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/c19f54c37f6d3dc392c3424e1fd2b932d6bdac33\"\u003e\u003ccode\u003ec19f54c\u003c/code\u003e\u003c/a\u003e chore: Release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/crate-ci/typos/commit/d65608bb75a732976ed0132999033d5ffcbf481b\"\u003e\u003ccode\u003ed65608b\u003c/code\u003e\u003c/a\u003e docs: Update changelog\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/crate-ci/typos/compare/7c572958218557a3272c2d6719629443b5cc26fd...5374cbf686e897b15713110e233094e2874de7ef\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/actions-marketplace-validations/afadesigns_zshellcheck/pull/1","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions-marketplace-validations%2Fafadesigns_zshellcheck/issues/1","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/1/packages"}},{"old_version":"2.3.5","new_version":"2.3.8","update_type":"patch","path":null,"pr_created_at":"2026-05-15T07:38:25.000Z","version_change":"2.3.5 → 2.3.8","issue":{"uuid":"4452187301","node_id":"PR_kwDOSMpAB87b06yA","number":60,"state":"open","title":"build(deps): bump google/osv-scanner-action from 2.3.5 to 2.3.8","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-05-15T07:38:25.000Z","updated_at":"2026-05-16T05:33:44.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"build(deps)","packages":[{"name":"google/osv-scanner-action","old_version":"2.3.5","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [google/osv-scanner-action](https://github.com/google/osv-scanner-action) from 2.3.5 to 2.3.8.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9517144e5504957104c831530fe605bfdc71f353\"\u003e\u003ccode\u003e9517144\u003c/code\u003e\u003c/a\u003e feat: output results in reusable workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f17cd09224d6ef8be953fb49371e6bffb2dbf44a\"\u003e\u003ccode\u003ef17cd09\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into main\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/c51854704019a247608d928f370c98740469d4b5...9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n","html_url":"https://github.com/blamejs/blamejs/pull/60","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/blamejs%2Fblamejs/issues/60","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/60/packages"}},{"old_version":"2.3.5","new_version":"2.3.8","update_type":"patch","path":null,"pr_created_at":"2026-05-15T04:48:14.000Z","version_change":"2.3.5 → 2.3.8","issue":{"uuid":"4451334962","node_id":"PR_kwDORTvYl87byQQj","number":188,"state":"open","title":"chore(deps): bump google/osv-scanner-action from 2.3.5 to 2.3.8","user":"dependabot[bot]","labels":["dependencies","ci"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-05-15T04:48:14.000Z","updated_at":"2026-05-15T04:48:22.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps)","packages":[{"name":"google/osv-scanner-action","old_version":"2.3.5","new_version":"2.3.8","repository_url":"https://github.com/google/osv-scanner-action"}],"path":null,"ecosystem":"actions"},"body":"Bumps [google/osv-scanner-action](https://github.com/google/osv-scanner-action) from 2.3.5 to 2.3.8.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/google/osv-scanner-action/releases\"\u003egoogle/osv-scanner-action's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.3.8\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cp\u003eThis updates OSV-Scanner to v2.3.8.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\"\u003ehttps://github.com/google/osv-scanner-action/compare/v2.3.5...v2.3.8\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003e\u003ccode\u003e9a49870\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.8 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/3adb4b14a2b0623876d18d863a498b785fb3752d\"\u003e\u003ccode\u003e3adb4b1\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.8 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/8dc09193bb540e09b23da07ad7e30bd33bf87018\"\u003e\u003ccode\u003e8dc0919\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.8 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/43f380b8fc43a816831a9f5ee6fc91170809c7e9\"\u003e\u003ccode\u003e43f380b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/125\"\u003e#125\u003c/a\u003e from google/update-to-v2.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/dcf4ddd504dac1027e5829c1d754e4ec009ded5d\"\u003e\u003ccode\u003edcf4ddd\u003c/code\u003e\u003c/a\u003e Update unified workflow example to point to v2.3.6 reusable workflows\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/b9dbb7ef6f6fb8d0e762912b668d2c4c236090a3\"\u003e\u003ccode\u003eb9dbb7e\u003c/code\u003e\u003c/a\u003e Update reusable workflows to point to v2.3.6 actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/fe54858b54b6e367472aa1828429dfcf3c95aba6\"\u003e\u003ccode\u003efe54858\u003c/code\u003e\u003c/a\u003e \u0026quot;Update actions to use v2.3.6 osv-scanner image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/eb5b619bb565d10623076caba5263750fde3c790\"\u003e\u003ccode\u003eeb5b619\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/google/osv-scanner-action/issues/100\"\u003e#100\u003c/a\u003e from thomasleplus/main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/9517144e5504957104c831530fe605bfdc71f353\"\u003e\u003ccode\u003e9517144\u003c/code\u003e\u003c/a\u003e feat: output results in reusable workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/google/osv-scanner-action/commit/f17cd09224d6ef8be953fb49371e6bffb2dbf44a\"\u003e\u003ccode\u003ef17cd09\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into main\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/google/osv-scanner-action/compare/c51854704019a247608d928f370c98740469d4b5...9a498708959aeaef5ef730655706c5a1df1edbc2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google/osv-scanner-action\u0026package-manager=github_actions\u0026previous-version=2.3.5\u0026new-version=2.3.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/takenek/homebridge-xiaomi-air-purifier-modern/pull/188","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/takenek%2Fhomebridge-xiaomi-air-purifier-modern/issues/188","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/188/packages"}}]}