chore(deps): bump the github-actions group across 1 directory with 5 updates by dependabot[bot] · Pull Request #484 · aziontech/lib

dependabot · 2026-10-14T19:02:41Z

Bumps the github-actions group with 5 updates in the / directory:

Package	From	To
actions/checkout	`4.4.0`	`7.0.1`
github/codeql-action/init	`4.37.5`	`4.38.3`
github/codeql-action/analyze	`4.37.5`	`4.38.3`
ossf/scorecard-action	`2.4.3`	`2.5.0`
google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml	`2.2.2`	`2.6.0`

Updates actions/checkout from 4.4.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464

update error wording by @aiqiaoy in actions/checkout#2467

New Contributors

@aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

[BREAKING] backport allow-unsafe-pr-checkout to v6 by @aiqiaoy in actions/checkout#2500

backport fixes to releases-v6 by @aiqiaoy in actions/checkout#2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

Update changelog by @ericsciple in actions/checkout#2357

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

Update changelog for v6.0.3 by @yaananth in actions/checkout#2446

New Contributors

@yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @TingluoHuang in actions/checkout#2355

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

Skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

Trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

Escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

v7.0.0

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Various dependency updates

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

... (truncated)

Commits

3d3c42e prep v7.0.1 release (#2531)
2880268 escape values passed to --unset (#2530)
12cd223 trim only ascii whitespace for branch (#2521)
62661c4 skip running unsafe pr check if input is default (#2518)
e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
631c942 eslint 9 (#2474)
4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
ba09753 Bump actions/checkout from 6 to 7 (#2488)
b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
Additional commits viewable in compare view

Updates github/codeql-action/init from 4.37.5 to 4.38.3

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.3

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

v4.38.2

Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

v4.37.7

Update default CodeQL bundle version to 2.26.3. #4085

v4.37.6

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

4.38.3 - 08 Oct 2026

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

... (truncated)

Commits

24c5418 Merge pull request #4214 from github/update-v4.38.3-e0b52dbdc
69e87c5 Add changelog note for #4184
23b6828 Update changelog for v4.38.3
e0b52db Merge pull request #4210 from github/henrymercer/pin-python-for-older-clis-in-ci
6b99698 Pin Python 3.13.15 for older CLI versions in multi-language check
63d3d63 Merge pull request #4203 from github/update-bundle/codeql-bundle-v2.27.2
7377a10 Add changelog note
c1a30cd Update default bundle to codeql-bundle-v2.27.2
d208ec7 Merge pull request #4200 from github/mbg/esm/migrate-pr-checks
a71b0c6 Replace __dirname in sync.ts
Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.5 to 4.38.3

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.38.3

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

v4.38.2

Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

v4.37.7

Update default CodeQL bundle version to 2.26.3. #4085

v4.37.6

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

4.38.3 - 08 Oct 2026

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

... (truncated)

Commits

24c5418 Merge pull request #4214 from github/update-v4.38.3-e0b52dbdc
69e87c5 Add changelog note for #4184
23b6828 Update changelog for v4.38.3
e0b52db Merge pull request #4210 from github/henrymercer/pin-python-for-older-clis-in-ci
6b99698 Pin Python 3.13.15 for older CLI versions in multi-language check
63d3d63 Merge pull request #4203 from github/update-bundle/codeql-bundle-v2.27.2
7377a10 Add changelog note
c1a30cd Update default bundle to codeql-bundle-v2.27.2
d208ec7 Merge pull request #4200 from github/mbg/esm/migrate-pr-checks
a71b0c6 Replace __dirname in sync.ts
Additional commits viewable in compare view

Updates ossf/scorecard-action from 2.4.3 to 2.5.0

Release notes

Sourced from ossf/scorecard-action's releases.

v2.5.0

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the Scorecard v5.6.0 release notes.

The action's container image is built with Go 1.27.2 on a refreshed distroless base. by @justaugustus in ossf/scorecard-action#1716

The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @justaugustus in ossf/scorecard-action#1716

The Scorecard version in results now always matches the Scorecard release the action is built with. by @justaugustus in ossf/scorecard-action#1718

The action no longer prints the GitHub token variable while validating its options. by @arpitjain099 in ossf/scorecard-action#1709

results_format accepts intoto, which wraps the JSON results in an in-toto attestation statement. by @puerco in ossf/scorecard-action#1702

Other

Add a daily canary against Scorecard main by @justaugustus in ossf/scorecard-action#1711

Bump Scorecard to the v5.6.0 candidate and fix the canary toolchain by @justaugustus in ossf/scorecard-action#1714

Run Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update RELEASE.md by @justaugustus in ossf/scorecard-action#1716

Bump Scorecard to v5.6.0 by @justaugustus in ossf/scorecard-action#1719

New Contributors

@arpitjain099 made their first contribution in ossf/scorecard-action#1709

@puerco made their first contribution in ossf/scorecard-action#1702

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

v2.4.4

What's Changed

This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the Scorecard v5.4.0 release notes and the Scorecard v5.5.0 release notes.

log POST failures instead of failing entire action by @spencerschrock in ossf/scorecard-action#1625

Full Changelog: ossf/scorecard-action@v2.4.3...v2.4.4

Commits

fa7117d Bump action tag for v2.5.0 release (#1720)
cef4eb5 🌱 Bump Scorecard to v5.6.0 (#1719)
bedb16e ✨ Add intoto results format (#1702)
de70347 Remove the leftover debug print of the auth token (#1709)
950873d 🌱 Derive the reported Scorecard version from go.mod (#1718)
2ce8ee4 🌱 Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (#1695)
aabdf5a 🌱 Bump the github-actions group across 1 directory with 7 updates (#...
b4b9adf 🌱 CodeQL: Analyze workflows instead of a placeholder JavaScript file
4e9f2a2 📖 RELEASE.md: Document drafting release notes
f618e8b 🌱 Build the image with Go 1.27.2 and refresh distroless
Additional commits viewable in compare view

Updates google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 2.2.2 to 2.6.0

Release notes

Sourced from google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml's releases.

v2.6.0

What's Changed

Fix JSON results export by @thomasleplus in google/osv-scanner-action#142

Fail the job when a scan does not complete by @alimony in google/osv-scanner-action#139

chore: Update to v2.6.0 by @another-rex in google/osv-scanner-action#144

New Contributors

@alimony made their first contribution in google/osv-scanner-action#139

@thomasleplus made their first contribution in google/osv-scanner-action#142

Full Changelog: google/osv-scanner-action@v2.5.1...v2.6.0

v2.5.1

This updates OSV-Scanner to v2.3.8.

What's Changed

Update actions/checkout action to v7 by @renovate-bot in google/osv-scanner-action#133

Fixes:

Preserve package namespaces when querying osv.dev API (fixes #2978).

Re-add support for the OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY environment variable (fixes #2983).

Fix local vulnerability matching (--offline-vulnerabilities) not working when network capability is NetworkOnline.

Full Changelog: google/osv-scanner-action@v2.5.0...v2.5.1

v2.5.0

This updates OSV-Scanner to v2.5.0 as well as:

What's Changed

feat: gate reusable workflow outputs with a flag by @another-rex in google/osv-scanner-action#130

Pin download-artifact action to SHA by @SVilgelm in google/osv-scanner-action#127

feat: add runs-on input to reusable workflows by @BeyondEvil in google/osv-scanner-action#131

fix: address zizmor warnings by @another-rex in google/osv-scanner-action#135

fix: add GOTOOLCHAIN=auto env to osv-scanner calls by @another-rex in google/osv-scanner-action#138

New Contributors

@SVilgelm made their first contribution in google/osv-scanner-action#127

@BeyondEvil made their first contribution in google/osv-scanner-action#131

Full Changelog: google/osv-scanner-action@v2.3.8...v2.5.0

v2.3.8

What's Changed

This updates OSV-Scanner to v2.3.8.

Full Changelog: google/osv-scanner-action@v2.3.5...v2.3.8

v2.3.5

This updates OSV-Scanner to v2.3.5.

... (truncated)

Commits

a345acf Merge pull request #144 from google/update-to-v2.6.0
6b289e0 Update unified workflow example to point to v2.6.0 reusable workflows
c7c7bcb Update reusable workflows to point to v2.6.0 actions
7f58dd6 "Update actions to use v2.6.0 osv-scanner image"
8e5cf47 Merge pull request #139 from alimony/fail-closed-on-incomplete-scan
bf5f924 Merge remote-tracking branch 'upstream/main' into fail-closed-on-incomplete-scan
ffa0a5f Merge pull request #142 from google/fix-json-export-code
259ba4a Fix JSON results export
6e4298e Merge pull request #141 from google/update-to-v2.5.1
5957b4e Update unified workflow example to point to v2.5.1 reusable workflows
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…updates Bumps the github-actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.4.0` | `7.0.1` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.5` | `4.38.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.5` | `4.38.3` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.3` | `2.5.0` | | [google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml](https://github.com/google/osv-scanner-action) | `2.2.2` | `2.6.0` | Updates `actions/checkout` from 4.4.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4.4.0...3d3c42e) Updates `github/codeql-action/init` from 4.37.5 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@d1ba80a...24c5418) Updates `github/codeql-action/analyze` from 4.37.5 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@d1ba80a...24c5418) Updates `ossf/scorecard-action` from 2.4.3 to 2.5.0 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@4eaacf0...fa7117d) Updates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml` from 2.2.2 to 2.6.0 - [Release notes](https://github.com/google/osv-scanner-action/releases) - [Commits](google/osv-scanner-action@90b209d...a345acf) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: ossf/scorecard-action dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml dependency-version: 2.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-10-14T19:03:08Z

SCC Complexity Analysis

Title: chore(deps): bump the github-actions group across 1 directory with 5 updates
Author: dependabot[bot]

Metric	Source Branch (dependabot/github_actions/github-actions-f3a2bfd502)	Target Branch (main)	Difference
Complexity	3933	3933	0
Code	64768	64768	0

dependabot Bot requested a review from a team October 14, 2026 19:02

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 14, 2026

dependabot Bot requested a review from a team as a code owner October 14, 2026 19:02

dependabot Bot added the github_actions Pull requests that update GitHub Actions code label Oct 14, 2026

Navigation Menu

Repository navigation

chore(deps): bump the github-actions group across 1 directory with 5 updates - #484

chore(deps): bump the github-actions group across 1 directory with 5 updates#484
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-f3a2bfd502

dependabot Bot commented on behalf of github Oct 14, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.0.1

What's Changed

v7.0.0

What's Changed

New Contributors

v6.1.0

What's Changed

v6.0.3

What's Changed

New Contributors

v6.0.2

What's Changed

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.38.3

v4.38.2

v4.38.1

v4.38.0

v4.37.9

v4.37.8

v4.37.7

v4.37.6

CodeQL Action Changelog

[UNRELEASED]

4.38.3 - 08 Oct 2026

4.38.2 - 24 Sept 2026

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

4.37.9 - 26 Aug 2026

4.37.8 - 21 Aug 2026

4.37.7 - 13 Aug 2026

4.37.6 - 04 Aug 2026

4.37.5 - 03 Aug 2026

4.37.4 - 29 Jul 2026

v4.38.3

v4.38.2

v4.38.1

v4.38.0

v4.37.9

v4.37.8

v4.37.7

v4.37.6

CodeQL Action Changelog

[UNRELEASED]

4.38.3 - 08 Oct 2026

4.38.2 - 24 Sept 2026

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

4.37.9 - 26 Aug 2026

4.37.8 - 21 Aug 2026

4.37.7 - 13 Aug 2026

4.37.6 - 04 Aug 2026

4.37.5 - 03 Aug 2026

4.37.4 - 29 Jul 2026

v2.5.0

What's Changed

Other

New Contributors

v2.4.4

What's Changed

v2.6.0

What's Changed

New Contributors

v2.5.1

What's Changed

Fixes:

dependabot Bot commented on behalf of github Oct 14, 2026 •

edited

Loading