Skip to content

ci(deps): bump the github-actions group across 1 directory with 13 updates - #159

Merged
mbarbero merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-7eebe14f63
Oct 21, 2026
Merged

ci(deps): bump the github-actions group across 1 directory with 13 updates#159
mbarbero merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-7eebe14f63

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 13 updates in the / directory:

Package From To
step-security/harden-runner 2.21.1 2.22.1
github/codeql-action/upload-sarif 4.38.2 4.38.3
trufflesecurity/trufflehog 3.97.9 3.99.2
astral-sh/setup-uv 10.2.0 10.3.0
reviewdog/action-actionlint 1.77.0 1.80.0
reviewdog/action-suggester 1.26.1 1.26.2
reviewdog/action-markdownlint 0.31.2 0.31.4
actions/upload-artifact 7.0.1 7.0.2
graalvm/setup-graalvm 1.6.6 1.6.7
actions/download-artifact 8.0.1 8.0.2
github/codeql-action/init 4.38.2 4.38.3
github/codeql-action/autobuild 4.38.2 4.38.3
github/codeql-action/analyze 4.38.2 4.38.3

Updates step-security/harden-runner from 2.21.1 to 2.22.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.22.1

What's Changed

  • Fixed security rules not initializing on GHES self-hosted runners
  • Fixed GHES connectivity in block mode by implicitly allowing the GHES hostname

Full Changelog: step-security/harden-runner@v2.22.0...v2.22.1

v2.22.0

What's Changed

  • Linux ARM64 support for community tier
  • GHES support for self-hosted VMs (enterprise tier)
  • MacOS and Windows runner deny list support for block policy (enterprise tier).

Full Changelog: step-security/harden-runner@v2.21.1...v2.22.0

Commits
  • ccd8616 Merge pull request #704 from h0x0er/jatin/ghes-endp
  • 037ccfd implicitly add ghes endpoint in allowList
  • e7438c7 Merge pull request #703 from h0x0er/jatin/ghes-codebuild-fixes
  • afb0b33 fixes for armour rules not getting initialised
  • 351661c Merge pull request #701 from step-security/rc-44
  • 1dc7f2e Merge pull request #702 from h0x0er/jatin/ghes-changes-up
  • af5ca38 simplified ghes config creation
  • 9a6d710 fix2
  • 74c65ea fix
  • ceac816 resovled comments
  • Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.38.2 to 4.38.3

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.38.3

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184
Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.0 - 15 Oct 2026

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

  • Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

... (truncated)

Commits
  • 24c5418 Merge pull request #4214 from github/update-v4.38.3-e0b52dbdc
  • 69e87c5 Add changelog note for #4184
  • 23b6828 Update changelog for v4.38.3
  • e0b52db Merge pull request #4210 from github/henrymercer/pin-python-for-older-clis-in-ci
  • 6b99698 Pin Python 3.13.15 for older CLI versions in multi-language check
  • 63d3d63 Merge pull request #4203 from github/update-bundle/codeql-bundle-v2.27.2
  • 7377a10 Add changelog note
  • c1a30cd Update default bundle to codeql-bundle-v2.27.2
  • d208ec7 Merge pull request #4200 from github/mbg/esm/migrate-pr-checks
  • a71b0c6 Replace __dirname in sync.ts
  • Additional commits viewable in compare view

Updates trufflesecurity/trufflehog from 3.97.9 to 3.99.2

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.99.2

What's Changed

Full Changelog: trufflesecurity/trufflehog@v3.99.1...v3.99.2

v3.99.1

What's Changed

Full Changelog: trufflesecurity/trufflehog@v3.99.0...v3.99.1

v3.99.0

What's Changed

Full Changelog: trufflesecurity/trufflehog@v3.98.1...v3.99.0

v3.98.1

What's Changed

New Contributors

Full Changelog: trufflesecurity/trufflehog@v3.98.0...v3.98.1

v3.98.0

What's Changed

... (truncated)

Commits
  • e76dff8 Somehow forgot to pull the config value into the engine (#5402)
  • 005b692 [INT-1084] Make the results deduplication cache size configurable (#5399)
  • f6499ff Update github-actions (#5363)
  • b2b0a92 Add OAuth2 (ROPC) auth for verification requests (#5392)
  • ab5ee07 Fix Sumo Logic detector ignoring configured verifier endpoints (#5395)
  • 4c282f5 Add api_timeout_seconds to Gerrit source proto (#5394)
  • c95844e Add a TruffleHog dectector for Kong Konnect Platform (#5305)
  • cc79781 Add postman source documentation (#5389)
  • 0186870 Add pkg/ssrf shared egress guard; use it for WithNoLocalIP and analyzer clien...
  • bb9ed13 docs: point five internal links at files that exist (#5375)
  • Additional commits viewable in compare view

Updates astral-sh/setup-uv from 10.2.0 to 10.3.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.0 🌈 Add Python architecture selection

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

🚀 Enhancements

🧰 Maintenance

⬆️ Dependency updates

Commits

Updates reviewdog/action-actionlint from 1.77.0 to 1.80.0

Release notes

Sourced from reviewdog/action-actionlint's releases.

Release v1.80.0

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.79.1...v1.80.0

Release v1.79.1

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.79.0...v1.79.1

Release v1.79.0

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.78.1...v1.79.0

Release v1.78.1

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.78.0...v1.78.1

Release v1.78.0

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.77.0...v1.78.0

Commits
  • a8ac3ee bump v1.80.0
  • 1e5dbb7 Merge branch 'main' into releases/v1
  • 130b9f8 Merge pull request #250 from reviewdog/renovate/pyflakes-4.x
  • c9958fc chore(deps): update dependency pyflakes to v4.0.3
  • 1758727 bump v1.79.1
  • 835705a Merge branch 'main' into releases/v1
  • 2b6687f Merge pull request #249 from reviewdog/renovate/python-3.14.8-alpine3.24
  • 91d36b3 chore(deps): update python:3.14.8-alpine3.24 docker digest to f6a589d
  • a1e3e7f bump v1.79.0
  • 0a63bd8 Merge branch 'main' into releases/v1
  • Additional commits viewable in compare view

Updates reviewdog/action-suggester from 1.26.1 to 1.26.2

Release notes

Sourced from reviewdog/action-suggester's releases.

Release v1.26.2

What's Changed

Full Changelog: reviewdog/action-suggester@v1.26.1...v1.26.2

Commits
  • 8219e3d Merge pull request #150 from reviewdog/renovate/reviewdog-action-actionlint-1.x
  • 1a214b9 chore(deps): update reviewdog/action-actionlint action to v1.80.0
  • e2afd88 Merge pull request #149 from reviewdog/renovate/reviewdog-action-misspell-1.x
  • 3b6d147 chore(deps): update reviewdog/action-misspell action to v1.30.2
  • e7837e5 Merge pull request #148 from reviewdog/renovate/reviewdog-action-actionlint-1.x
  • 9bc5cd8 chore(deps): update reviewdog/action-actionlint action to v1.79.1
  • b73c59b Merge pull request #147 from reviewdog/renovate/reviewdog-action-actionlint-1.x
  • d795439 chore(deps): update reviewdog/action-actionlint action to v1.79.0
  • 9cfa780 Merge pull request #146 from reviewdog/renovate/reviewdog-action-actionlint-1.x
  • 77e7203 chore(deps): update reviewdog/action-actionlint action to v1.78.1
  • Additional commits viewable in compare view

Updates reviewdog/action-markdownlint from 0.31.2 to 0.31.4

Release notes

Sourced from reviewdog/action-markdownlint's releases.

Release v0.31.4

What's Changed

Full Changelog: reviewdog/action-markdownlint@v0.31.3...v0.31.4

Release v0.31.3

What's Changed

Full Changelog: reviewdog/action-markdownlint@v0.31.2...v0.31.3

Commits
  • 34762a7 bump v0.31.4
  • 04938ec Merge branch 'master' into releases/v0
  • 2cccf75 Merge pull request #102 from reviewdog/renovate/node-24-bookworm-slim
  • a899167 chore(deps): update node.js to d6aa754
  • d6b1ab6 bump v0.31.3
  • 29e084a Merge branch 'master' into releases/v0
  • 3db18e4 Merge pull request #101 from reviewdog/renovate/node-24-bookworm-slim
  • 2f921b6 chore(deps): update node.js to eae779f
  • 8714c9b Merge pull request #100 from reviewdog/renovate/shogo82148-actions-create-rel...
  • f53dc81 chore(deps): update shogo82148/actions-create-release action to v1.9.2
  • See full diff in compare view

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.

New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits
  • cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
  • c2acded chore: prepare v7.0.2 release
  • 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
  • 8cbe1be Bump @​actions/artifact to 6.3.1
  • See full diff in compare view

Updates graalvm/setup-graalvm from 1.6.6 to 1.6.7

Release notes

Sourced from graalvm/setup-graalvm's releases.

v1.6.7

What's Changed

Full Changelog: graalvm/setup-graalvm@v1.6.6...v1.6.7

Commits
  • 27b360d Bump version to 1.6.7.
  • 5465633 Document 25i-latest and update README.md.
  • 975bdb0 Add support for 25i-latest.
  • 311f4df Drop misleading notes.
  • 9df65ca Only run test-action-extensive with GDS_TOKEN.
  • cd60bef Bump the all group with 13 updates
  • 8b5fb99 Fix fetchArtifactByJavaVersion
  • eebbe52 Update to latest 17 CPU.
  • cce64d5 Run npm audit fix && npm run bundle.
  • f21c44e Bump undici from 6.28.0 to 6.29.0
  • Additional commits viewable in compare view

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits
  • 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
  • e455989 Prepare download-artifact v8.0.2
  • a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
  • 29bb7ce Update @​actions/artifact to 6.3.1
  • 484a0b5 Update the readme (#473)
  • See full diff in compare view

Updates github/codeql-action/init from 4.38.2 to 4.38.3

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.3

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184
Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.0 - 15 Oct 2026

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

  • Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

... (truncated)

Commits
  • 24c5418 Merge pull request #4214 from github/update-v4.38.3-e0b52dbdc
  • 69e87c5 Add changelog note for #4184
  • 23b6828 Update changelog for v4.38.3
  • e0b52db Merge pull request #4210 from github/henrymercer/pin-python-for-older-clis-in-ci
  • 6b99698 Pin Python 3.13.15 for older CLI versions in multi-language check
  • 63d3d63 Merge pull request #4203 from github/update-bundle/codeql-bundle-v2.27.2
  • 7377a10 Add changelog note
  • c1a30cd Update default bundle to codeql-bundle-v2.27.2
  • d208ec7 Merge pull request #4200 from github/mbg/esm/migrate-pr-checks
  • a71b0c6 Replace __dirname in sync.ts
  • Additional commits viewable in compare view

Updates github/codeql-action/autobuild from 4.38.2 to 4.38.3

Release notes

Sourced from github/codeql-action/autobuild's releases.

v4.38.3

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks.

@dependabot
ci(deps): bump the github-actions group across 1 directory with 13 up…
036b6fa 
…dates

Bumps the github-actions group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.21.1` | `2.22.1` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |
| [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) | `3.97.9` | `3.99.2` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.2.0` | `10.3.0` |
| [reviewdog/action-actionlint](https://github.com/reviewdog/action-actionlint) | `1.77.0` | `1.80.0` |
| [reviewdog/action-suggester](https://github.com/reviewdog/action-suggester) | `1.26.1` | `1.26.2` |
| [reviewdog/action-markdownlint](https://github.com/reviewdog/action-markdownlint) | `0.31.2` | `0.31.4` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` |
| [graalvm/setup-graalvm](https://github.com/graalvm/setup-graalvm) | `1.6.6` | `1.6.7` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |
| [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |



Updates `step-security/harden-runner` from 2.21.1 to 2.22.1
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@e14015d...ccd8616)

Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@2892aa5...24c5418)

Updates `trufflesecurity/trufflehog` from 3.97.9 to 3.99.2
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@4dd8831...e76dff8)

Updates `astral-sh/setup-uv` from 10.2.0 to 10.3.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@c18668a...1c37ad0)

Updates `reviewdog/action-actionlint` from 1.77.0 to 1.80.0
- [Release notes](https://github.com/reviewdog/action-actionlint/releases)
- [Commits](reviewdog/action-actionlint@2085657...a8ac3ee)

Updates `reviewdog/action-suggester` from 1.26.1 to 1.26.2
- [Release notes](https://github.com/reviewdog/action-suggester/releases)
- [Commits](reviewdog/action-suggester@c387862...8219e3d)

Updates `reviewdog/action-markdownlint` from 0.31.2 to 0.31.4
- [Release notes](https://github.com/reviewdog/action-markdownlint/releases)
- [Commits](reviewdog/action-markdownlint@a223028...34762a7)

Updates `actions/upload-artifact` from 7.0.1 to 7.0.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@043fb46...cf430e0)

Updates `graalvm/setup-graalvm` from 1.6.6 to 1.6.7
- [Release notes](https://github.com/graalvm/setup-graalvm/releases)
- [Commits](graalvm/setup-graalvm@0426e2e...27b360d)

Updates `actions/download-artifact` from 8.0.1 to 8.0.2
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@3e5f45b...9000827)

Updates `github/codeql-action/init` from 4.38.2 to 4.38.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@2892aa5...24c5418)

Updates `github/codeql-action/autobuild` from 4.38.2 to 4.38.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@2892aa5...24c5418)

Updates `github/codeql-action/analyze` from 4.38.2 to 4.38.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@2892aa5...24c5418)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.22.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.99.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: reviewdog/action-actionlint
  dependency-version: 1.80.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: reviewdog/action-suggester
  dependency-version: 1.26.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: reviewdog/action-markdownlint
  dependency-version: 0.31.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: graalvm/setup-graalvm
  dependency-version: 1.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies This issue or pull request is about third-party dependencies label Oct 19, 2026
@sonarqubecloud

sonarqubecloud Bot commented Oct 19, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@mbarbero
mbarbero merged commit 9886aa4 into main Oct 21, 2026
27 checks passed
@mbarbero
mbarbero deleted the dependabot/github_actions/github-actions-7eebe14f63 branch October 21, 2026 19:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies This issue or pull request is about third-party dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mbarbero