Sourced from step-security/harden-runner's releases.

v2.12.1

What's Changed

• Detection capabilities have been upgraded to better recognize attempts at runner tampering. These improvements are informed by real-world incident learnings, including analysis of anomalous behaviors observed in the tj-actions and reviewdog supply chain attack.
• Resolved an issue where the block policy was not enforced correctly when the GitHub Actions job was running inside a container on a self-hosted VM runner.

Full Changelog: https://github.com/step-security/harden-runner/compare/v2...v2.12.1

• 002fdce Merge pull request #544 from step-security/rc-21
• 2489e3f Merge branch 'main' into rc-21
• 75dd441 Merge pull request #555 from step-security/dependabot/github_actions/step-sec...
• 4381ace Bump step-security/publish-unit-test-result-action from 2.19.0 to 2.20.0
• a9da90b Merge pull request #553 from h0x0er/feat/container-workflows
• a60ef21 update
• 4ad512f Merge branch 'rc-21' into feat/container-workflows
• 6b41a39 fixed test case
• fa70c45 update agent
• eb47845 self-hosted: refactored block-policy apply logic
• Additional commits viewable in compare view

Sourced from docker/setup-buildx-action's releases.

v3.11.1

• Fix keep-state not being respected by @​crazy-max in docker/setup-buildx-action#429

Full Changelog: https://github.com/docker/setup-buildx-action/compare/v3.11.0...v3.11.1

v3.11.0

• Keep BuildKit state support by @​crazy-max in docker/setup-buildx-action#427
• Remove aliases created when installing by default by @​hashhar in docker/setup-buildx-action#139
• Bump @​docker/actions-toolkit from 0.56.0 to 0.62.1 in docker/setup-buildx-action#422 docker/setup-buildx-action#425

Full Changelog: https://github.com/docker/setup-buildx-action/compare/v3.10.0...v3.11.0

• e468171 Merge pull request #429 from crazy-max/fix-keep-state
• a3e7502 chore: update generated content
• b145473 fix keep-state not being respected
• 18ce135 Merge pull request #425 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 0e198e9 chore: update generated content
• 05f3f3a build(deps): bump @​docker/actions-toolkit from 0.61.0 to 0.62.1
• 6229134 Merge pull request #427 from crazy-max/keep-state
• c6f6a07 chore: update generated content
• 6c5e29d skip builder creation if one already exists with the same name
• 548b297 ci: keep-state check
• Additional commits viewable in compare view

Sourced from docker/build-push-action's releases.

v6.18.0

• Bump @​docker/actions-toolkit from 0.61.0 to 0.62.1 in docker/build-push-action#1381

[!NOTE] Build summary is now supported with Docker Build Cloud.

Full Changelog: https://github.com/docker/build-push-action/compare/v6.17.0...v6.18.0

• 2634353 Merge pull request #1381 from docker/dependabot/npm_and_yarn/docker/actions-t...
• c0432d2 chore: update generated content
• 0bb1f27 set builder driver and endpoint attributes for dbc summary support
• 5f9dbf9 chore(deps): Bump @​docker/actions-toolkit from 0.61.0 to 0.62.1
• 0788c44 Merge pull request #1375 from crazy-max/remove-gcr
• aa179ca e2e: remove GCR
• See full diff in compare view

Sourced from stefanzweifel/git-auto-commit-action's releases.

v6.0.1

Fixed

• Disable Check if Repo is in Detached State (#379) @​stefanzweifel

v6.0.0

Added

• Throw error early if repository is in a detached state (#357)

Fixed

• Fix PAT instructions with Dependabot (#376) @​Dreamsorcerer

Removed

• Remove support for create_branch, skip_checkout, skip_Fetch (#314)

Sourced from stefanzweifel/git-auto-commit-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Unreleased

TBD

v6.0.1 - 2025-06-11

Fixed

• Disable Check if Repo is in Detached State (#379) @​stefanzweifel

v6.0.0 - 2025-06-10

Added

• Throw error early if repository is in a detached state (#357)

Fixed

• Fix PAT instructions with Dependabot (#376) @​Dreamsorcerer

Removed

• Remove support for create_branch, skip_checkout, skip_Fetch (#314)

v5.2.0 - 2025-04-19

Added

• Add create_git_tag_only option to skip commiting and always create a git-tag. (#364) @​zMynxx
• Add Test for create_git_tag_only feature (#367) @​stefanzweifel

Fixed

• docs: Update README.md per #354 (#361) @​rasa

v5.1.0 - 2025-01-11

Changed

• Include github.actor_id in default commit_author (#354) @​parkerbxyz

Fixed

... (truncated)

• 778341a Merge pull request #379 from stefanzweifel/disable-detached-state-check
• 33b203d Disable Check if Repo is in Detached State
• a82d80a Update CHANGELOG
• 3cc016c Merge pull request #375 from stefanzweifel/v6-next
• ddb7ae4 Merge pull request #376 from Dreamsorcerer/patch-1
• b001e5f Apply suggestions from code review
• 6494dc6 Fix PAT instructions with Dependabot
• 7618051 Add deprecated inputs to fix unbound variable issue
• ae11462 Merge pull request #371 from stefanzweifel/dependabot/npm_and_yarn/bats-1.12.0
• 3058f91 Bump bats from 1.11.1 to 1.12.0
• Additional commits viewable in compare view

• f5aa288 :bug: QD-11047 fix issue with quick-fixes: pull-request (#490)
• 26b380e :bug: QD-11047 fix issue with quick-fixes in gitlab in branch mode (#482)
• See full diff in compare view

Sourced from ossf/scorecard-action's releases.

v2.4.2

What's Changed

This update bumps the Scorecard version to the v5.2.1 release. For a complete list of changes, please refer to the Scorecard v5.2.0 and v5.2.1 release notes.

Full Changelog: https://github.com/ossf/scorecard-action/compare/v2.4.1...v2.4.2

• 05b42c6 :seedling: bump docker to ghcr v2.4.2 (#1548)
• b225da6 Bump github.com/ossf/scorecard/v5 from v5.2.0 to v5.2.1 (#1550)
• 9399f6f :seedling: Bump the docker-images group across 1 directory with 2 updates (#1...
• e1daa8c :seedling: Bump the github-actions group across 1 directory with 5 updates (#...
• 9fe6511 :seedling: Bump golang.org/x/net from 0.39.0 to 0.40.0 (#1542)
• 25b9cd9 :seedling: Bump github.com/ossf/scorecard/v5 from v5.1.1 to v5.2.0 (#1547)
• 18cc9b8 :seedling: Bump golang.org/x/net from 0.38.0 to 0.39.0 (#1536)
• db78142 :seedling: Bump the github-actions group with 2 updates (#1538)
• de386ed :seedling: Bump golang from 1.24.1 to 1.24.2 in the docker-images group (#1534)
• 5b7cedb :seedling: Bump github.com/sigstore/cosign/v2 from 2.4.3 to 2.5.0 (#1537)
• Additional commits viewable in compare view

Sourced from github/codeql-action's releases.

v3.29.0

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.0 - 11 Jun 2025

• Update default CodeQL bundle version to 2.22.0. #2925
• Bump minimum CodeQL bundle version to 2.16.6. #2912

See the full CHANGELOG.md for more information.

v3.28.19

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.19 - 03 Jun 2025

• The CodeQL Action no longer includes its own copy of the extractor for the actions language, which is currently in public preview. The actions extractor has been included in the CodeQL CLI since v2.20.6. If your workflow has enabled the actions language and you have pinned your tools: property to a specific version of the CodeQL CLI earlier than v2.20.6, you will need to update to at least CodeQL v2.20.6 or disable actions analysis.
• Update default CodeQL bundle version to 2.21.4. #2910

See the full CHANGELOG.md for more information.

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• Fix bug in PR analysis where user-provided include query filter fails to exclude non-included queries. #2938

3.29.0 - 11 Jun 2025

• Update default CodeQL bundle version to 2.22.0. #2925
• Bump minimum CodeQL bundle version to 2.16.6. #2912

3.28.19 - 03 Jun 2025

• The CodeQL Action no longer includes its own copy of the extractor for the actions language, which is currently in public preview. The actions extractor has been included in the CodeQL CLI since v2.20.6. If your workflow has enabled the actions language and you have pinned your tools: property to a specific version of the CodeQL CLI earlier than v2.20.6, you will need to update to at least CodeQL v2.20.6 or disable actions analysis.
• Update default CodeQL bundle version to 2.21.4. #2910

3.28.18 - 16 May 2025

• Update default CodeQL bundle version to 2.21.3. #2893
• Skip validating SARIF produced by CodeQL for improved performance. #2894
• The number of threads and amount of RAM used by CodeQL can now be set via the CODEQL_THREADS and CODEQL_RAM runner environment variables. If set, these environment variables override the threads and ram inputs respectively. #2891

3.28.17 - 02 May 2025

• Update default CodeQL bundle version to 2.21.2. #2872

3.28.16 - 23 Apr 2025

• Update default CodeQL bundle version to 2.21.1. #2863

3.28.15 - 07 Apr 2025

• Fix bug where the action would fail if it tried to produce a debug artifact with more than 65535 files. #2842

3.28.14 - 07 Apr 2025

• Update default CodeQL bundle version to 2.21.0. #2838

3.28.13 - 24 Mar 2025

No user facing changes.

3.28.12 - 19 Mar 2025

• Dependency caching should now cache more dependencies for Java build-mode: none extractions. This should speed up workflows and avoid inconsistent alerts in some cases.

... (truncated)

• ce28f5b Merge pull request #2926 from github/update-v3.29.0-e8799281c
• bc251b7 Update changelog for v3.29.0
• e879928 Merge pull request #2925 from github/update-bundle/codeql-bundle-v2.22.0
• efd43b3 Merge branch 'main' into update-bundle/codeql-bundle-v2.22.0
• 7cb9b16 Merge pull request #2912 from github/henrymercer/bump-minimum-codeql-2.16.6
• 3855117 Add changelog note
• f5d4e2a Update default bundle to codeql-bundle-v2.22.0
• 22deae8 Update package-lock.json
• df2a830 Merge branch 'main' into henrymercer/bump-minimum-codeql-2.16.6
• b1e4dc3 Merge pull request #2916 from github/dependabot/npm_and_yarn/npm-5cdccdc43f
• Additional commits viewable in compare view

Sourced from dorny/test-reporter's releases.

v2.1.0

What's Changed

• Fix broken links in report summary by @​micmarc in dorny/test-reporter#567
• Increase step summary limit to 1MiB by @​OlesGalatsan in dorny/test-reporter#581
• Fix for empty TRX TestDefinitions by @​OlesGalatsan in dorny/test-reporter#582
• Feature: Add summary title by @​micmarc in dorny/test-reporter#568
• Fix input description for list options by @​Vampire in dorny/test-reporter#572
• Add Golang test parser by @​Shamus03 in dorny/test-reporter#571
• docs: make sure list-tests is correctly documented on action.yml by @​lucasoares in dorny/test-reporter#577
• Update npm packages by @​jozefizso in dorny/test-reporter#583
• test-reporter release v2.1.0 by @​jozefizso in dorny/test-reporter#584

New Contributors

• @​micmarc made their first contribution in dorny/test-reporter#567
• @​OlesGalatsan made their first contribution in dorny/test-reporter#581
• @​Vampire made their first contribution in dorny/test-reporter#572
• @​Shamus03 made their first contribution in dorny/test-reporter#571
• @​lucasoares made their first contribution in dorny/test-reporter#577

Full Changelog: https://github.com/dorny/test-reporter/compare/v2.0.0...v2.1.0

Sourced from dorny/test-reporter's changelog.

Changelog

2.1.0

• Feature: Add summary title dorny/test-reporter#568
• Feature: Add Golang test parser dorny/test-reporter#571
• Increase step summary limit to 1MiB dorny/test-reporter#581
• Fix for empty TRX TestDefinitions dorny/test-reporter#582
• Fix input description for list options dorny/test-reporter#572
• Update npm packages dorny/test-reporter#583

2.0.0

• Parse JUnit report with detailed message in failure dorny/test-reporter#559
• Support displaying test results in markdown using GitHub Actions Job Summaries dorny/test-reporter#383

1.9.1

• Fix problematic retransmission of authentication token dorny/test-reporter#438
• Report correct number of tests in Dart dorny/test-reporter#426
• Number of completed tests mismatches passed/failed dorny/test-reporter#319

1.9.0

• Add support for Rspec (Ruby) dorny/test-reporter#398

1.8.0

• Add SwiftXunitParser class based on JavaJunitParser for swift-xunit reporter dorny/test-reporter#317
• Use NodeJS 18 LTS as default runtime dorny/test-reporter#332
• Escape <> characters in suite name dorny/test-reporter#236
• Update actions runtime to Node20 dorny/test-reporter#315
• Update check title and remove icon dorny/test-reporter#144

1.7.0

• Fix #199: Use ✅ instead of ✔️ for better cross platform look by @​petrdvorak in dorny/test-reporter#200
• Verify content of dist/ folder matches build output by @​dorny in dorny/test-reporter#207
• Gracefully handle empty nested testsuite elements for JUnit. by @​rvdlaarschot in dorny/test-reporter#193
• Gracefully handle empty failure tags by @​haudren-woven in dorny/test-reporter#213
• Fix #208 - java-junit: show annotations on PR changed files by @​atsu85 in dorny/test-reporter#209
• Only report failure if fail-on-error is set by @​trond-snekvik in dorny/test-reporter#214
• Improve clarity on configuring for forkable repos by @​abelbraaksma in dorny/test-reporter#211
• Suppress "Processing test results from" log by @​vasanthdharmaraj in dorny/test-reporter#179
• Skip listing of files if error parsing is disabled by @​dorny in dorny/test-reporter#216
• Correct typo in docs by @​tangowithfoxtrot in dorny/test-reporter#254
• update dependencies by @​j-catania in dorny/test-reporter#269
• Add permissions to example yml files by @​TurnrDev in dorny/test-reporter#263
• add feature fail-on-empty by @​gdams in dorny/test-reporter#243
• Add dependabot configuration by @​yeikel in dorny/test-reporter#228
• Bump ws from 7.3.1 to 7.5.9 in /reports/jest by @​dependabot in dorny/test-reporter#265
• Bump actions/checkout from 2 to 4 by @​dependabot in dorny/test-reporter#279
• Add new output for url url html by @​luisito666 in dorny/test-reporter#242
• Update README.md by @​IanMoroney in dorny/test-reporter#158
• Update jest-Junit part of Readme by @​ryancasburn-KAI in dorny/test-reporter#176
• fix: default-valued fields are not mandatory by @​TomerFi in dorny/test-reporter#172

... (truncated)

• 890a17c test-reporter release v2.1.0
• 53f5051 test-reporter release v2.1.0
• d6ff56a Merge pull request #583 from dorny/chore/update_packages
• b0baeed Rebuild dist
• ebe4a9b Upgrade npm packages
• 4a3cfcd Upgrade typescript to v5.8.3
• 84bcb5d Merge pull request #577 from lucasoares/patch-1
• a8c55a3 Merge pull request #571 from Shamus03/feature/golang-json-parser
• a0398fb Correct behavior for test cases with slashes
• 34f1c56 register parser and update readme
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions