Bump the github-actions-version-updates group across 1 directory with 5 updates

Open

Number: #3389
Type: Pull Request
State: Open

Author:

dependabot[bot]
Association: Unknown
Comments: 2

Created: November 24, 2025 at 09:46 AM UTC
(about 1 month ago)

Updated: November 24, 2025 at 09:47 AM UTC
(about 1 month ago)

Labels:
dependencies github_actions

Description:

Bumps the github-actions-version-updates group with 5 updates in the /.github/workflows directory:

Package	From	To
actions/checkout	`5.0.0`	`6.0.0`
actions/setup-go	`6.0.0`	`6.1.0`
github/codeql-action	`4.31.2`	`4.31.5`
mikefarah/yq	`4.48.1`	`4.49.1`
peter-evans/create-pull-request	`7.0.8`	`7.0.9`

Updates actions/checkout from 5.0.0 to 6.0.0

Release notes

Sourced from actions/checkout's releases.

v6.0.0

What's Changed

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

Persist creds to a separate file by @ericsciple in actions/checkout#2286

v6-beta by @ericsciple in actions/checkout#2298

update readme/changelog for v6 by @ericsciple in actions/checkout#2311

Full Changelog: https://github.com/actions/checkout/compare/v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

Full Changelog: https://github.com/actions/checkout/compare/v5...v5.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

V6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

V5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

V5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

V4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

V4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

v4.2.0

Add Ref and Commit outputs by @lucacome in actions/checkout#1180

Dependency updates by @dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in actions/checkout#1739

Bump actions/checkout from 3 to 4 by @dependabot in actions/checkout#1697

Check out other refs/* by commit by @orhantoy in actions/checkout#1774

Pin actions/checkout's own workflows to a known, good, stable version. by @jww3 in actions/checkout#1776

v4.1.6

Check platform to set archive extension appropriately by @cory-miller in actions/checkout#1732

v4.1.5

Update NPM dependencies by @cory-miller in actions/checkout#1703

Bump github/codeql-action from 2 to 3 by @dependabot in actions/checkout#1694

Bump actions/setup-node from 1 to 4 by @dependabot in actions/checkout#1696

Bump actions/upload-artifact from 2 to 4 by @dependabot in actions/checkout#1695

... (truncated)

Commits

1af3b93 update readme/changelog for v6 (#2311)
71cf226 v6-beta (#2298)
069c695 Persist creds to a separate file (#2286)
ff7abcd Update README to include Node.js 24 support details and requirements (#2248)
See full diff in compare view

Updates actions/setup-go from 6.0.0 to 6.1.0

Release notes

Sourced from actions/setup-go's releases.

v6.1.0

What's Changed

Enhancements

Fall back to downloading from go.dev/dl instead of storage.googleapis.com/golang by @nicholasngai in actions/setup-go#665

Add support for .tool-versions file and update workflow by @priya-kinthali in actions/setup-go#673

Add comprehensive breaking changes documentation for v6 by @mahabaleshwars in actions/setup-go#674

Dependency updates

Upgrade eslint-config-prettier from 10.0.1 to 10.1.8 and document breaking changes in v6 by @dependabot in actions/setup-go#617

Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @dependabot in actions/setup-go#641

Upgrade semver and @types/semver by @dependabot in actions/setup-go#652

New Contributors

@nicholasngai made their first contribution in actions/setup-go#665

@priya-kinthali made their first contribution in actions/setup-go#673

@mahabaleshwars made their first contribution in actions/setup-go#674

Full Changelog: https://github.com/actions/setup-go/compare/v6...v6.1.0

Commits

4dc6199 Bump semver and @types/semver (#652)
f3787be Add comprehensive breaking changes documentation for v6 (#674)
3a0c2c8 Bump actions/publish-action from 0.3.0 to 0.4.0 (#641)
faf5242 Add support for .tool-versions file in setup-go, update workflow (#673)
7bc60db Fall back to downloading from go.dev/dl instead of storage.googleapis.com/gol...
c0137ca Bump eslint-config-prettier from 10.0.1 to 10.1.8 and document breaking chang...
See full diff in compare view

Updates github/codeql-action from 4.31.2 to 4.31.5

Release notes

Sourced from github/codeql-action's releases.

v4.31.5

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.5 - 24 Nov 2025

Update default CodeQL bundle version to 2.23.6. #3321

See the full CHANGELOG.md for more information.

v4.31.4

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.4 - 18 Nov 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v4.31.3

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.3 - 13 Nov 2025

CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see Upcoming deprecation of CodeQL Action v3.

Update default CodeQL bundle version to 2.23.5. #3288

See the full CHANGELOG.md for more information.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

Update default CodeQL bundle version to 2.23.6. #3321

4.31.4 - 18 Nov 2025

No user facing changes.

4.31.3 - 13 Nov 2025

CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see Upcoming deprecation of CodeQL Action v3.

Update default CodeQL bundle version to 2.23.5. #3288

4.31.2 - 30 Oct 2025

No user facing changes.

4.31.1 - 30 Oct 2025

The add-snippets input has been removed from the analyze action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.

4.31.0 - 24 Oct 2025

Bump minimum CodeQL bundle version to 2.17.6. #3223

When SARIF files are uploaded by the analyze or upload-sarif actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the upload-sarif action. For analyze, this may affect Advanced Setup for CodeQL users who specify a value other than always for the upload input. #3222

4.30.9 - 17 Oct 2025

Update default CodeQL bundle version to 2.23.3. #3205

Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #3204

4.30.8 - 10 Oct 2025

No user facing changes.

4.30.7 - 06 Oct 2025

[v4+ only] The CodeQL Action now runs on Node.js v24. #3169

3.30.6 - 02 Oct 2025

Update default CodeQL bundle version to 2.23.2. #3168

3.30.5 - 26 Sep 2025

We fixed a bug that was introduced in 3.30.4 with upload-sarif which resulted in files without a .sarif extension not getting uploaded. #3160

... (truncated)

Commits

fdbfb4d Merge pull request #3322 from github/update-v4.31.5-ec2ee575c
81f6d64 Update changelog for v4.31.5
ec2ee57 Merge pull request #3321 from github/update-bundle/codeql-bundle-v2.23.6
ecc8787 Add changelog note
1d2a238 Update default bundle to codeql-bundle-v2.23.6
ce729e4 Merge pull request #3315 from github/henrymercer/dead-code-elimination
ac359aa Add return type
112cd07 Merge branch 'main' into henrymercer/dead-code-elimination
0b43179 Merge pull request #3306 from github/dependabot/npm_and_yarn/types/sinon-21.0.0
e818008 Merge pull request #3305 from github/dependabot/npm_and_yarn/eslint/compat-2.0.0
Additional commits viewable in compare view

Updates mikefarah/yq from 4.48.1 to 4.49.1

Release notes

Sourced from mikefarah/yq's releases.

v4.49.1 - Security Flags and TOML fixes

Added --security flags to disable env and file ops #2515

Fixing TOML ArrayTable parsing issues #1758

Fixing parsing of escaped characters #2506

v4.48.2

Strip whitespace when decoding base64 #2507

Upgraded to go-yaml v4! (thanks @ccoVeille, @ingydotnet)

Add linux/loong64 to release target (thanks @znley)

Added --shell-key-separator flag for customizable shell output format #2497 (thanks @rsleedbx)

Bumped dependencies

Changelog

Sourced from mikefarah/yq's changelog.

4.49.1:

Added --security flags to disable env and file ops #2515

Fixing TOML ArrayTable parsing issues #1758

Fixing parsing of escaped characters #2506

4.48.2:

Strip whitespace when decoding base64 #2507

Upgraded to go-yaml v4! (thanks @ccoVeille, @ingydotnet)

Add linux/loong64 to release target (thanks @znley)

Added --shell-key-separator flag for customizable shell output format #2497 (thanks @rsleedbx)

Bumped dependencies

4.48.1:

Added 'parents' operator, to return a list of all the hierarchical parents of a node

Added 'first(exp)' operator, to return the first entry matching an expression in an array

Fixed xml namespace prefixes #1730 (thanks @baodrate)

Fixed out of range panic in yaml decoder #2460 (thanks @n471d)

Bumped dependencies

4.47.2:

Conversion from TOML to JSON no longer omits empty tables #2459 (thanks @louislouislouislouis)

Bumped dependencies

4.47.1:

Fixed merge anchor behaviour (<<); #2404, #2110, #2386, #2178 Huge thanks to @stevenwdv! Note that you will need to set --yaml-fix-merge-anchor-to-spec to see the fixes

Fixed panic for syntax error when creating a map #2423

Bumped dependencies

4.46.1:

Added INI support

Fixed 'add' operator when piped in with no data #2378, #2383, #2384

Fixed delete after slice problem (bad node path) #2387 Thanks @antoinedeschenes

Fixed yq small build Thanks @imzue

Switched to YAML org supported go-yaml!

Bumped dependencies

4.45.4:

Fixing wrong map() behaviour on empty map #2359

Bumped dependencies

4.45.3:

Fixing regression introduced with in 4.45.2 with #2325 fix :sweat: sorry folks!

Bumped dependencies

4.45.2:

Added windows arm builds (Thanks @albertocavalcante, @ShukantPal)

Added s390x platform support (Thanks @ashokpariya0)

Additionally push docker images to ghcr.io (Thanks @reegnz)

... (truncated)

Commits

45be35c Bumping version
39fbf01 Fixing TOML ArrayTable parsing issues #1758
306dc93 Fixing TOML ArrayTable parsing issues #1758
f00852b Added flags to disable env and file ops #2515
c716d15 Fixing parsing of escaped characters in strenv #2506
e49e588 Fixing parsing of escaped characters #2506
3894868 Updating release notes
d32e71f Updating release notes
796317b Bumping version
258b84a Strip whitespace when decoding base64 #2507
Additional commits viewable in compare view

Updates peter-evans/create-pull-request from 7.0.8 to 7.0.9

Release notes

Sourced from peter-evans/create-pull-request's releases.

Create Pull Request v7.0.9

⚙️ Fixes an incompatibility with the recently released actions/checkout@v6.

What's Changed

~70 dependency updates by @dependabot

docs: fix workaround description about ready_for_review by @ybiquitous in peter-evans/create-pull-request#3939

Docs: add-paths default behavior by @joeflack4 in peter-evans/create-pull-request#3928

docs: update to create-github-app-token v2 by @Goooler in peter-evans/create-pull-request#4063

Fix compatibility with actions/checkout@v6 by @ericsciple in peter-evans/create-pull-request#4230

New Contributors

@joeflack4 made their first contribution in peter-evans/create-pull-request#3928

@Goooler made their first contribution in peter-evans/create-pull-request#4063

@ericsciple made their first contribution in peter-evans/create-pull-request#4230

Full Changelog: https://github.com/peter-evans/create-pull-request/compare/v7.0.8...v7.0.9

Commits

84ae59a fix: compatibility with actions/checkout@v6 (#4230)
b4733b9 build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (#4222)
0edc001 build(deps-dev): bump the npm group with 2 updates (#4201)
430aea0 build(deps): bump the github-actions group with 3 updates (#4200)
46cdba7 build(deps-dev): bump the npm group with 3 updates (#4185)
b937339 build(deps): bump the github-actions group with 2 updates (#4184)
e9af275 ci: update dependabot config
d3e081a build(deps-dev): bump @types/node from 18.19.127 to 18.19.128 (#4178)
9ec683e build(deps-dev): bump @types/node from 18.19.125 to 18.19.127 (#4165)
65d8d10 build(deps-dev): bump ts-jest from 29.4.2 to 29.4.4 (#4163)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Package Dependencies

Package:
actions/checkout

Ecosystem:
actions

Version Change:
5.0.0 → 6.0.0

Update Type:
Major

Package:
actions/setup-go

Ecosystem:
actions

Version Change:
6.0.0 → 6.1.0

Update Type:
Minor

Package:
github/codeql-action

Ecosystem:
actions

Version Change:
4.31.2 → 4.31.5

Update Type:
Patch

Package:
peter-evans/create-pull-request

Ecosystem:
actions

Version Change:
7.0.8 → 7.0.9

Update Type:
Patch

Package:
mikefarah/yq

Ecosystem:
actions

Version Change:
4.48.1 → 4.49.1

Update Type:
Minor

Actions

View on GitHub View Repository All Dependabot PRs

Technical Details

ID:	`11326589`
UUID:	`3658015449`
Node ID:	`PR_kwDOBM-Q_c61JuQc`
Host:	GitHub
Repository:	secureCodeBox/secureCodeBox