build(deps): bump the actions-deps group with 6 updates #7142

dependabot · 2025-07-24T22:41:39Z

Bumps the actions-deps group with 6 updates:

Package	From	To
step-security/harden-runner	`2.12.1`	`2.13.0`
actions/upload-artifact	`4.6.1`	`4.6.2`
sigstore/cosign-installer	`e9a05e6d32d7ed22b5656cd874ef31af58d05bfa`	`d58896d6a1865668819e1d91763c7751a165e159`
anchore/sbom-action	`0.20.1`	`0.20.4`
ossf/scorecard-action	`2.4.1`	`2.4.2`
github/codeql-action	`3.29.0`	`3.29.4`

Updates step-security/harden-runner from 2.12.1 to 2.13.0

Release notes

Sourced from step-security/harden-runner's releases.

v2.13.0

What's Changed

Improved job markdown summary

Https monitoring for all domains (included with the enterprise tier)

Full Changelog: step-security/harden-runner@v2...v2.13.0

v2.12.2

What's Changed

Added HTTPS Monitoring for additional destinations - *.githubusercontent.com Bug fixes:

Implicitly allow local multicast, local unicast and broadcast IP addresses in block mode

Increased policy map size for block mode

Full Changelog: step-security/harden-runner@v2...v2.12.2

Commits

ec9f2d5 Merge pull request #565 from step-security/rc-24
04bcbc3 update agent
7c7a56f feat: get job summary from API
6c439dc Merge pull request #562 from step-security/rc-22
bf56886 update agent
5436dac update agent
88d305a update agent
b976878 update agent
875cc92 Update agent
See full diff in compare view

Updates actions/upload-artifact from 4.6.1 to 4.6.2

Release notes

Sourced from actions/upload-artifact's releases.

v4.6.2

What's Changed

Update to use artifact 2.3.2 package & prepare for new upload-artifact release by @salmanmkc in actions/upload-artifact#685

New Contributors

@salmanmkc made their first contribution in actions/upload-artifact#685

Full Changelog: actions/upload-artifact@v4...v4.6.2

Commits

ea165f8 Merge pull request #685 from salmanmkc/salmanmkc/3-new-upload-artifacts-release
0839620 Prepare for new release of actions/upload-artifact with new toolkit cache ver...
See full diff in compare view

Updates sigstore/cosign-installer from e9a05e6d32d7ed22b5656cd874ef31af58d05bfa to d58896d6a1865668819e1d91763c7751a165e159

Commits

d58896d Update default to v2.5.3 (#196)
e40248c drop old unsupported versions <v2.0.0 (#192)
d9374b9 not fail fast and setup permissions (#195)
398d4b0 default cosign to v2.5.2 (#194)
84f54a2 default action install to use release v2.5.1 (#193)
fb28c2b bump cosign install to use release v2.5.0 as default (#191)
See full diff in compare view

Updates anchore/sbom-action from 0.20.1 to 0.20.4

Release notes

Sourced from anchore/sbom-action's releases.

v0.20.4

Changes in v0.20.4

chore: update Syft to v1.29.0 (#529)

v0.20.3

Changes in v0.20.3

Fix: Strip emojis from correlator before using github APIs (#527) [AndrewHendry]

v0.20.2

Changes in v0.20.2

Update Syft to v1.28.0 (#526)

Commits

7b36ad6 chore(deps): update Syft to v1.29.0 (#529)
9e07fd7 fix: strip emoji from correlator names (#527)
cee1b8e chore(deps): update Syft to v1.28.0 (#526)
See full diff in compare view

Updates ossf/scorecard-action from 2.4.1 to 2.4.2

Release notes

Sourced from ossf/scorecard-action's releases.

v2.4.2

What's Changed

This update bumps the Scorecard version to the v5.2.1 release. For a complete list of changes, please refer to the Scorecard v5.2.0 and v5.2.1 release notes.

Full Changelog: ossf/scorecard-action@v2.4.1...v2.4.2

Commits

05b42c6 🌱 bump docker to ghcr v2.4.2 (#1548)
b225da6 Bump github.com/ossf/scorecard/v5 from v5.2.0 to v5.2.1 (#1550)
9399f6f 🌱 Bump the docker-images group across 1 directory with 2 updates (#1...
e1daa8c 🌱 Bump the github-actions group across 1 directory with 5 updates (#...
9fe6511 🌱 Bump golang.org/x/net from 0.39.0 to 0.40.0 (#1542)
25b9cd9 🌱 Bump github.com/ossf/scorecard/v5 from v5.1.1 to v5.2.0 (#1547)
18cc9b8 🌱 Bump golang.org/x/net from 0.38.0 to 0.39.0 (#1536)
db78142 🌱 Bump the github-actions group with 2 updates (#1538)
de386ed 🌱 Bump golang from 1.24.1 to 1.24.2 in the docker-images group (#1534)
5b7cedb 🌱 Bump github.com/sigstore/cosign/v2 from 2.4.3 to 2.5.0 (#1537)
Additional commits viewable in compare view

Updates github/codeql-action from 3.29.0 to 3.29.4

Release notes

Sourced from github/codeql-action's releases.

v3.29.4

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.4 - 23 Jul 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.29.3

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.3 - 21 Jul 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.29.2

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.2 - 30 Jun 2025

Experimental: When the quality-queries input for the init action is provided with an argument, separate .quality.sarif files are produced and uploaded for each language with the results of the specified queries. Do not use this in production as it is part of an internal experiment and subject to change at any time. #2935

See the full CHANGELOG.md for more information.

v3.29.1

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.1 - 27 Jun 2025

Fix bug in PR analysis where user-provided include query filter fails to exclude non-included queries. #2938

Update default CodeQL bundle version to 2.22.1. #2950

See the full CHANGELOG.md for more information.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

3.29.4 - 23 Jul 2025

No user facing changes.

3.29.3 - 21 Jul 2025

No user facing changes.

3.29.2 - 30 Jun 2025

Experimental: When the quality-queries input for the init action is provided with an argument, separate .quality.sarif files are produced and uploaded for each language with the results of the specified queries. Do not use this in production as it is part of an internal experiment and subject to change at any time. #2935

3.29.1 - 27 Jun 2025

Fix bug in PR analysis where user-provided include query filter fails to exclude non-included queries. #2938

Update default CodeQL bundle version to 2.22.1. #2950

3.29.0 - 11 Jun 2025

Update default CodeQL bundle version to 2.22.0. #2925

Bump minimum CodeQL bundle version to 2.16.6. #2912

3.28.20 - 21 July 2025

Remove support for combining SARIF files from a single upload for GHES 3.18, see the changelog post. #2959

3.28.19 - 03 Jun 2025

The CodeQL Action no longer includes its own copy of the extractor for the actions language, which is currently in public preview. The actions extractor has been included in the CodeQL CLI since v2.20.6. If your workflow has enabled the actions language and you have pinned your tools: property to a specific version of the CodeQL CLI earlier than v2.20.6, you will need to update to at least CodeQL v2.20.6 or disable actions analysis.

Update default CodeQL bundle version to 2.21.4. #2910

3.28.18 - 16 May 2025

Update default CodeQL bundle version to 2.21.3. #2893

Skip validating SARIF produced by CodeQL for improved performance. #2894

The number of threads and amount of RAM used by CodeQL can now be set via the CODEQL_THREADS and CODEQL_RAM runner environment variables. If set, these environment variables override the threads and ram inputs respectively. #2891

3.28.17 - 02 May 2025

... (truncated)

Commits

4e828ff Merge pull request #2989 from github/update-v3.29.4-37264dc0b
b3114b8 Update changelog for v3.29.4
37264dc Merge pull request #2988 from github/koesie10/disable-combine-single-file
5a29823 Merge remote-tracking branch 'origin/main' into koesie10/disable-combine-sing...
5a2327a Merge pull request #2987 from github/mbg/combine-sarif-error
287d421 Disable combining runs within a single file
43afe6e Treat processing error for multiple runs with the same category as configurat...
8f2e636 Merge pull request #2981 from github/dependabot/npm_and_yarn/npm-fe13dfda46
76bf77d Merge pull request #2980 from github/dependabot/github_actions/actions-504b6c...
9e7d13d Merge pull request #2983 from github/koesie10/update-changelog-link
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

CLAassistant · 2025-07-24T22:41:46Z

All committers have signed the CLA.

mholt · 2025-07-30T18:16:40Z

Weird that CLA Assistant is requiring a CLA sign for this, since dependabot is (and has historically been) exempt from it, I just checked and it's definitely in the exemption list. 🤔

mohammed90 · 2025-07-31T01:40:15Z

Weird that CLA Assistant is requiring a CLA sign for this, since dependabot is (and has historically been) exempt from it, I just checked and it's definitely in the exemption list. 🤔

Apparently, it's a known issue, cla-assistant/cla-assistant#852.

mholt · 2025-07-31T16:13:37Z

That is weird, that issue is from 2022. Wonder why it only started a few days ago.

Have the PRs always said "commented on behalf of github" like this? I just tried adding github to the list of exemptions but it still isn't working.

mohammed90 · 2025-07-31T16:16:52Z

It always had the same status, even on the older (now closed) PRs. Am I missing what you're referring to? I also don't see the "commenting on behalf of GitHub" thing 🤔

mholt · 2025-07-31T16:18:34Z

Oh just at the top of the PR comment: "dependabot (bot) commented on behalf of github last week"

mohammed90 · 2025-07-31T16:27:27Z

I don't know how the exception setting works, but can you try by using the support email address:

Signed-off-by: dependabot[bot] <[email protected]>

mholt · 2025-07-31T16:30:00Z

No unfortunately, it's just this, which should be the settings that work (and have worked before):

mohammed90 · 2025-08-01T00:22:09Z

@dependabot recreate

Bumps the actions-deps group with 6 updates: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.12.1` | `2.13.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.1` | `4.6.2` | | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `e9a05e6d32d7ed22b5656cd874ef31af58d05bfa` | `d58896d6a1865668819e1d91763c7751a165e159` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.20.1` | `0.20.4` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.1` | `2.4.2` | | [github/codeql-action](https://github.com/github/codeql-action) | `3.29.0` | `3.29.4` | Updates `step-security/harden-runner` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@002fdce...ec9f2d5) Updates `actions/upload-artifact` from 4.6.1 to 4.6.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4.6.1...ea165f8) Updates `sigstore/cosign-installer` from e9a05e6d32d7ed22b5656cd874ef31af58d05bfa to d58896d6a1865668819e1d91763c7751a165e159 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@e9a05e6...d58896d) Updates `anchore/sbom-action` from 0.20.1 to 0.20.4 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](anchore/sbom-action@9246b90...7b36ad6) Updates `ossf/scorecard-action` from 2.4.1 to 2.4.2 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@f49aabe...05b42c6) Updates `github/codeql-action` from 3.29.0 to 3.29.4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@ce28f5b...4e828ff) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: actions/upload-artifact dependency-version: 4.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: sigstore/cosign-installer dependency-version: d58896d6a1865668819e1d91763c7751a165e159 dependency-type: direct:production dependency-group: actions-deps - dependency-name: anchore/sbom-action dependency-version: 0.20.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: ossf/scorecard-action dependency-version: 2.4.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: github/codeql-action dependency-version: 3.29.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps ... Signed-off-by: dependabot[bot] <[email protected]>

mohammed90

LGTM!

…7142) Bumps the actions-deps group with 6 updates: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.12.1` | `2.13.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.1` | `4.6.2` | | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `e9a05e6d32d7ed22b5656cd874ef31af58d05bfa` | `d58896d6a1865668819e1d91763c7751a165e159` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.20.1` | `0.20.4` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.1` | `2.4.2` | | [github/codeql-action](https://github.com/github/codeql-action) | `3.29.0` | `3.29.4` | Updates `step-security/harden-runner` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@002fdce...ec9f2d5) Updates `actions/upload-artifact` from 4.6.1 to 4.6.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4.6.1...ea165f8) Updates `sigstore/cosign-installer` from e9a05e6d32d7ed22b5656cd874ef31af58d05bfa to d58896d6a1865668819e1d91763c7751a165e159 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@e9a05e6...d58896d) Updates `anchore/sbom-action` from 0.20.1 to 0.20.4 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](anchore/sbom-action@9246b90...7b36ad6) Updates `ossf/scorecard-action` from 2.4.1 to 2.4.2 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@f49aabe...05b42c6) Updates `github/codeql-action` from 3.29.0 to 3.29.4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@ce28f5b...4e828ff) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: actions/upload-artifact dependency-version: 4.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: sigstore/cosign-installer dependency-version: d58896d6a1865668819e1d91763c7751a165e159 dependency-type: direct:production dependency-group: actions-deps - dependency-name: anchore/sbom-action dependency-version: 0.20.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: ossf/scorecard-action dependency-version: 2.4.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: github/codeql-action dependency-version: 3.29.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 24, 2025

This was referenced Jul 24, 2025

build(deps): bump step-security/harden-runner from 2.12.1 to 2.12.2 #7106

Closed

build(deps): bump github/codeql-action from 3.29.0 to 3.29.2 #7107

Closed

dependabot bot force-pushed the dependabot/github_actions/actions-deps-2f78b2bc38 branch from ee373c7 to bcf8414 Compare August 1, 2025 00:23

mohammed90 approved these changes Aug 1, 2025

View reviewed changes

mohammed90 merged commit 5bc2afb into master Aug 1, 2025
24 checks passed

mohammed90 deleted the dependabot/github_actions/actions-deps-2f78b2bc38 branch August 1, 2025 01:34

BrewTestBot mentioned this pull request Aug 22, 2025

caddy 2.10.1 Homebrew/homebrew-core#234522

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the actions-deps group with 6 updates #7142

build(deps): bump the actions-deps group with 6 updates #7142

Uh oh!

dependabot bot commented on behalf of github Jul 24, 2025 •

edited

Loading

Uh oh!

CLAassistant commented Jul 24, 2025 •

edited

Loading

Uh oh!

mholt commented Jul 30, 2025

Uh oh!

mohammed90 commented Jul 31, 2025

Uh oh!

mholt commented Jul 31, 2025

Uh oh!

mohammed90 commented Jul 31, 2025

Uh oh!

mholt commented Jul 31, 2025

Uh oh!

mohammed90 commented Jul 31, 2025

Uh oh!

mholt commented Jul 31, 2025

Uh oh!

mohammed90 commented Aug 1, 2025

Uh oh!

mohammed90 left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

build(deps): bump the actions-deps group with 6 updates #7142

build(deps): bump the actions-deps group with 6 updates #7142

Uh oh!

Conversation

dependabot bot commented on behalf of github Jul 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.13.0

What's Changed

v2.12.2

What's Changed

v4.6.2

What's Changed

New Contributors

v0.20.4

Changes in v0.20.4

v0.20.3

Changes in v0.20.3

v0.20.2

Changes in v0.20.2

v2.4.2

What's Changed

v3.29.4

CodeQL Action Changelog

3.29.4 - 23 Jul 2025

v3.29.3

CodeQL Action Changelog

3.29.3 - 21 Jul 2025

v3.29.2

CodeQL Action Changelog

3.29.2 - 30 Jun 2025

v3.29.1

CodeQL Action Changelog

3.29.1 - 27 Jun 2025

CodeQL Action Changelog

[UNRELEASED]

3.29.4 - 23 Jul 2025

3.29.3 - 21 Jul 2025

3.29.2 - 30 Jun 2025

3.29.1 - 27 Jun 2025

3.29.0 - 11 Jun 2025

3.28.20 - 21 July 2025

3.28.19 - 03 Jun 2025

3.28.18 - 16 May 2025

3.28.17 - 02 May 2025

Uh oh!

CLAassistant commented Jul 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mholt commented Jul 30, 2025

Uh oh!

mohammed90 commented Jul 31, 2025

Uh oh!

mholt commented Jul 31, 2025

Uh oh!

mohammed90 commented Jul 31, 2025

Uh oh!

mholt commented Jul 31, 2025

Uh oh!

mohammed90 commented Jul 31, 2025

Uh oh!

mholt commented Jul 31, 2025

Uh oh!

mohammed90 commented Aug 1, 2025

Uh oh!

mohammed90 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dependabot bot commented on behalf of github Jul 24, 2025 •

edited

Loading

CLAassistant commented Jul 24, 2025 •

edited

Loading