Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

Bump the all group across 1 directory with 6 updates

Open
Number: #611
Type: Pull Request
State: Open
Author: dependabot[bot] dependabot[bot]
Association: Contributor
Comments: 0
Created: October 06, 2025 at 04:08 AM UTC
(9 months ago)
Updated: October 06, 2025 at 04:08 AM UTC
(9 months ago)
Labels:
dependencies github_actions
Description:

Bumps the all group with 6 updates in the / directory:

Package From To
step-security/harden-runner 2.12.1 2.13.1
actions/checkout 4.2.2 5.0.0
github/codeql-action 3.29.0 3.30.6
actions/setup-node 4.4.0 5.0.0
actions/dependency-review-action 4.7.1 4.8.0
ossf/scorecard-action 2.4.2 2.4.3

Updates step-security/harden-runner from 2.12.1 to 2.13.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.13.1

What's Changed

  • Graceful handling of HTTP errors: Improved error handling when fetching Harden Runner policies from the StepSecurity Policy Store API, ensuring more reliable execution even in case of temporary network/API issues.

  • Security updates for npm dependencies: Updated vulnerable npm package dependencies to the latest secure versions.

  • Faster enterprise agent downloads: The enterprise agent is now downloaded from GitHub Releases instead of packages.stepsecurity.io, improving download speed and reliability.

Full Changelog: https://github.com/step-security/harden-runner/compare/v2.13.0...v2.13.1

v2.13.0

What's Changed

  • Improved job markdown summary
  • Https monitoring for all domains (included with the enterprise tier)

Full Changelog: https://github.com/step-security/harden-runner/compare/v2...v2.13.0

v2.12.2

What's Changed

Added HTTPS Monitoring for additional destinations - *.githubusercontent.com Bug fixes:

  • Implicitly allow local multicast, local unicast and broadcast IP addresses in block mode
  • Increased policy map size for block mode

Full Changelog: https://github.com/step-security/harden-runner/compare/v2...v2.12.2

Commits
  • f4a75cf Merge pull request #588 from step-security/rc-26
  • 95503d0 ci: remove code-review workflow
  • 4b250a0 ci: add job to confirm dist is as expected
  • 5b0ab6a update dependencies
  • d11f2c1 fix bug where status code was not being preserved
  • b3fc98e improve error handling for policy store sceanrio
  • 92fc5d4 update error message
  • b61b0a4 policy store improvements
  • e3d3f2b use GitHub release instead of packages
  • 646ac01 update agent
  • Additional commits viewable in compare view

Updates actions/checkout from 4.2.2 to 5.0.0

Release notes

Sourced from actions/checkout's releases.

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: https://github.com/actions/checkout/compare/v4...v5.0.0

v4.3.0

What's Changed

New Contributors

Full Changelog: https://github.com/actions/checkout/compare/v4...v4.3.0

Changelog

Sourced from actions/checkout's changelog.

Changelog

V5.0.0

V4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v4.1.5

v4.1.4

v4.1.3

... (truncated)

Commits

Updates github/codeql-action from 3.29.0 to 3.30.6

Release notes

Sourced from github/codeql-action's releases.

v3.30.6

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.6 - 02 Oct 2025

  • Update default CodeQL bundle version to 2.23.2. #3168

See the full CHANGELOG.md for more information.

v3.30.5

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.5 - 26 Sep 2025

  • We fixed a bug that was introduced in 3.30.4 with upload-sarif which resulted in files without a .sarif extension not getting uploaded. #3160

See the full CHANGELOG.md for more information.

v3.30.4

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.4 - 25 Sep 2025

  • We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the codeql-action/init step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the codeql-action/init step. #3099 and #3100
  • We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. #3107
  • You can now run the latest CodeQL nightly bundle by passing tools: nightly to the init action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. #3130
  • Update default CodeQL bundle version to 2.23.1. #3118

See the full CHANGELOG.md for more information.

v3.30.3

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.3 - 10 Sep 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.30.2

CodeQL Action Changelog

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

3.30.6 - 02 Oct 2025

  • Update default CodeQL bundle version to 2.23.2. #3168

3.30.5 - 26 Sep 2025

  • We fixed a bug that was introduced in 3.30.4 with upload-sarif which resulted in files without a .sarif extension not getting uploaded. #3160

3.30.4 - 25 Sep 2025

  • We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the codeql-action/init step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the codeql-action/init step. #3099 and #3100
  • We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. #3107
  • You can now run the latest CodeQL nightly bundle by passing tools: nightly to the init action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. #3130
  • Update default CodeQL bundle version to 2.23.1. #3118

3.30.3 - 10 Sep 2025

No user facing changes.

3.30.2 - 09 Sep 2025

  • Fixed a bug which could cause language autodetection to fail. #3084
  • Experimental: The quality-queries input that was added in 3.29.2 as part of an internal experiment is now deprecated and will be removed in an upcoming version of the CodeQL Action. It has been superseded by a new analysis-kinds input, which is part of the same internal experiment. Do not use this in production as it is subject to change at any time. #3064

3.30.1 - 05 Sep 2025

  • Update default CodeQL bundle version to 2.23.0. #3077

3.30.0 - 01 Sep 2025

  • Reduce the size of the CodeQL Action, speeding up workflows by approximately 4 seconds. #3054

3.29.11 - 21 Aug 2025

  • Update default CodeQL bundle version to 2.22.4. #3044

3.29.10 - 18 Aug 2025

No user facing changes.

3.29.9 - 12 Aug 2025

... (truncated)

Commits
  • 64d10c1 Merge pull request #3172 from github/update-v3.30.6-10feb5d2a
  • 909610e Update changelog for v3.30.6
  • 10feb5d Merge pull request #3167 from github/mbg/upload-sarif/find-then-filter
  • 4182ea3 Merge pull request #3168 from github/update-bundle/codeql-bundle-v2.23.2
  • 34afe5b Merge pull request #3171 from github/mbg/start-proxy/telemetry
  • 096fe67 Merge branch 'main' into update-bundle/codeql-bundle-v2.23.2
  • b496401 Merge pull request #3170 from github/mbg/start-proxy/remove-update-workflow
  • d573787 Report registry types that are configured for CodeQL in start-proxy telemetry
  • 1591680 Send a basic status report in start-proxy Action if it succeeds
  • cb5a284 Send status report when start-proxy fails
  • Additional commits viewable in compare view

Updates actions/setup-node from 4.4.0 to 5.0.0

Release notes

Sourced from actions/setup-node's releases.

v5.0.0

What's Changed

Breaking Changes

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless. To disable this automatic caching, set package-manager-cache: false

steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

New Contributors

Full Changelog: https://github.com/actions/setup-node/compare/v4...v5.0.0

Commits

Updates actions/dependency-review-action from 4.7.1 to 4.8.0

Release notes

Sourced from actions/dependency-review-action's releases.

v4.8.0

What's Changed

New Contributors

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4...v4.8.0

4.7.3

What's Changed

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4...v4.7.3

4.7.2

What's Changed

New Contributors

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4...v4.7.2

Commits
  • 56339e5 Merge pull request #988 from actions/brrygrdn/rc-4.8.0
  • 1688b74 Bump to a 4.8.0
  • 31c9f17 Merge pull request #987 from actions/rc-4.7.4
  • eacde78 Update version
  • 8151009 Merge pull request #986 from actions/brrygrdn/rc-4.7.4
  • b472ec9 Add a quick regression test for the artefact summary
  • e0cedc5 feat: add large summary handling with artifact upload
  • e3fdf0f This ensures large allow or deny lists don't create huge comments
  • 6fad417 Merge pull request #978 from actions/ljones140/make-ruby-code-scannable
  • e86e969 Update scripts/scan_pr_lib.rb
  • Additional commits viewable in compare view

Updates ossf/scorecard-action from 2.4.2 to 2.4.3

Release notes

Sourced from ossf/scorecard-action's releases.

v2.4.3

What's Changed

This update bumps the Scorecard version to the v5.3.0 release. For a complete list of changes, please refer to the Scorecard v5.3.0 release notes.

Documentation

Other

New Contributors

Full Changelog: https://github.com/ossf/scorecard-action/compare/v2.4.2...v2.4.3

Commits
  • 4eaacf0 bump docker to ghcr v2.4.3 (#1587)
  • 42e3a01 :seedling: Bump the github-actions group with 3 updates (#1585)
  • 88c07ac :seedling: Bump github.com/sigstore/cosign/v2 from 2.5.2 to 2.6.0 (#1579)
  • 6c690f2 Bump github.com/ossf/scorecard/v5 from v5.2.1 to v5.3.0 (#1586)
  • 92083b5 :book: Fix recommended command to test the image in development (#1583)
  • 7975ea6 :seedling: Bump the docker-images group across 1 directory with 2 updates (#1...
  • 0d1a743 :seedling: Bump github.com/spf13/cobra from 1.9.1 to 1.10.1 (#1575)
  • 46e6e0c :seedling: Bump the github-actions group with 2 updates (#1580)
  • c3f1350 :seedling: Improve printing options (#1584)
  • 43e475b :seedling: Bump golang.org/x/net from 0.42.0 to 0.44.0 (#1578)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
Pull Request Statistics
Commits:
1
Files Changed:
7
Additions:
+23
Deletions:
-23
Package Dependencies
Package:
actions/checkout
Ecosystem:
actions
Version Change:
4.2.2 → 5.0.0
Update Type:
Major
Package:
github/codeql-action
Ecosystem:
actions
Version Change:
3.29.0 → 3.30.6
Update Type:
Minor
Package:
actions/setup-node
Ecosystem:
actions
Version Change:
4.4.0 → 5.0.0
Update Type:
Major
Package:
ossf/scorecard-action
Ecosystem:
actions
Version Change:
2.4.2 → 2.4.3
Update Type:
Patch
Package:
actions/dependency-review-action
Ecosystem:
actions
Version Change:
4.7.1 → 4.8.0
Update Type:
Minor
Package:
step-security/harden-runner
Ecosystem:
actions
Version Change:
2.12.1 → 2.13.1
Update Type:
Minor
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 9521817
UUID: 2888753687
Node ID: PR_kwDOAHaIHc6sLuIX
Host: GitHub
Repository: nodejs/node-addon-examples
Merge State: Unknown