chore(deps): bump the github-action-dependencies group across 1 directory with 6 updates #1734

dependabot · 2025-11-21T05:25:19Z

Bumps the github-action-dependencies group with 6 updates in the / directory:

Package	From	To
actions/checkout	`5.0.0`	`6.0.0`
elgohr/Publish-Docker-Github-Action	`1d95820b6952cab6e48a2454ff6ca9804bf65f31`	`15cc35eb4da44fc6b93b817f1e1a5f01b5456e50`
golangci/golangci-lint-action	`8.0.0`	`9.0.0`
svenstaro/upload-release-action	`2.11.2`	`2.11.3`
mikefarah/yq	`4.48.1`	`4.48.2`
github/codeql-action	`4.31.2`	`4.31.4`

Updates actions/checkout from 5.0.0 to 6.0.0

Release notes

Sourced from actions/checkout's releases.

v6.0.0

What's Changed

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

Persist creds to a separate file by @ericsciple in actions/checkout#2286

v6-beta by @ericsciple in actions/checkout#2298

update readme/changelog for v6 by @ericsciple in actions/checkout#2311

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

Full Changelog: actions/checkout@v5...v5.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

V6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

V5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

V5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

V4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

V4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

v4.2.0

Add Ref and Commit outputs by @lucacome in actions/checkout#1180

Dependency updates by @dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in actions/checkout#1739

Bump actions/checkout from 3 to 4 by @dependabot in actions/checkout#1697

Check out other refs/* by commit by @orhantoy in actions/checkout#1774

Pin actions/checkout's own workflows to a known, good, stable version. by @jww3 in actions/checkout#1776

v4.1.6

Check platform to set archive extension appropriately by @cory-miller in actions/checkout#1732

v4.1.5

Update NPM dependencies by @cory-miller in actions/checkout#1703

Bump github/codeql-action from 2 to 3 by @dependabot in actions/checkout#1694

Bump actions/setup-node from 1 to 4 by @dependabot in actions/checkout#1696

Bump actions/upload-artifact from 2 to 4 by @dependabot in actions/checkout#1695

... (truncated)

Commits

1af3b93 update readme/changelog for v6 (#2311)
71cf226 v6-beta (#2298)
069c695 Persist creds to a separate file (#2286)
ff7abcd Update README to include Node.js 24 support details and requirements (#2248)
See full diff in compare view

Updates elgohr/Publish-Docker-Github-Action from 1d95820b6952cab6e48a2454ff6ca9804bf65f31 to 15cc35eb4da44fc6b93b817f1e1a5f01b5456e50

Commits

15cc35e Merge pull request #232 from elgohr/dependabot/docker/ubuntu-c35e29c
2017e76 Bump ubuntu from e96e81f to c35e29c
30b5fbd Merge pull request #231 from elgohr/dependabot/docker/ubuntu-e96e81f
097f2e7 Bump ubuntu from 66460d5 to e96e81f
See full diff in compare view

Updates golangci/golangci-lint-action from 8.0.0 to 9.0.0

Release notes

Sourced from golangci/golangci-lint-action's releases.

v9.0.0

In the scope of this release, we change Nodejs runtime from node20 to node24 (https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/).

What's Changed

Changes

feat: add install-only option by @ldez in golangci/golangci-lint-action#1305

feat: support Module Plugin System by @ldez in golangci/golangci-lint-action#1306

Full Changelog: golangci/golangci-lint-action@v8.0.0...v9.0.0

Commits

0a35821 docs: update readme
043b1b8 feat: support Module Plugin System (#1306)
a66d26a feat: add install-only option (#1305)
7fe1b22 build(deps): bump the dependencies group with 2 updates (#1303)
14973f1 build(deps-dev): bump the dev-dependencies group with 2 updates (#1299)
8c2d575 build(deps): bump @types/node from 24.8.1 to 24.9.1 in the dependencies group...
b002b6e build(deps): bump actions/setup-node from 5 to 6 (#1296)
c13f4ed build(deps): bump @types/node from 24.7.2 to 24.8.1 in the dependencies group...
b68d21b docs: improve readme
06188a2 build(deps): bump github/codeql-action from 3 to 4 (#1293)
Additional commits viewable in compare view

Updates svenstaro/upload-release-action from 2.11.2 to 2.11.3

Release notes

Sourced from svenstaro/upload-release-action's releases.

2.11.3

Post-fix Github errors - releases created as draft when they shouldn't have been - #99

Changelog

Sourced from svenstaro/upload-release-action's changelog.

Changelog

[2.11.3] - 2025-11-20

Post-fix releases created as draft when they shouldn't have - #99

[2.11.2] - 2025-07-06

Solved race-condition when matrix builds try to create the same release at the same time - #147

[2.11.1] - 2025-06-30

Adds a release_id output, and optional input, for uploading files to release - #136 (thanks @alexis-opolka)

[2.10.0] - 2025-06-21

Adds the ability to disable duplicate check, for lower Github API usage - #142 (thanks @colinsullivan)

[2.9.1] - 2025-06-21

Fixed development + CI, updated dependencies #137

[2.9.0] - 2024-02-22

Allow setting a release as draft #112 (thanks @ShonP40)

[2.8.0] - 2024-02-21

Bump all deps

Update to node 20

[2.7.0] - 2023-07-28

Allow setting an explicit target_commitish #46 (thanks @Spikatrix)

[2.6.1] - 2023-05-31

Do not overwrite body or name if empty #108 (thanks @regevbr)

[2.6.0] - 2023-05-23

Add make_latest input parameter. Can be set to false to prevent the created release from being marked as the latest release for the repository #100 (thanks @brandonkelly)

Don't try to upload empty files #102 (thanks @Loyalsoldier)

Bump all deps #105

overwrite option also overwrites name and body #106 (thanks @regevbr)

Add promote option to allow prereleases to be promoted #74 (thanks @regevbr)

[2.5.0] - 2023-02-21

Add retry to upload release #96 (thanks @sonphantrung)

[2.4.1] - 2023-02-01

Modernize octokit usage

[2.4.0] - 2023-01-09

Update to node 16

Bump most dependencies

[2.3.0] - 2022-06-05

Now defaults repo_token to ${{ github.token }} and tag to ${{ github.ref }} #69 (thanks @leighmcculloch)

... (truncated)

Commits

6b7fa9f 2.11.3
d78c255 Fix releases that are created as drafts (github error) (#151)
7027b76 Update README.md - explicated permission error resolution
See full diff in compare view

Updates mikefarah/yq from 4.48.1 to 4.48.2

Release notes

Sourced from mikefarah/yq's releases.

v4.48.2

Strip whitespace when decoding base64 #2507

Upgraded to go-yaml v4! (thanks @ccoVeille, @ingydotnet)

Add linux/loong64 to release target (thanks @znley)

Added --shell-key-separator flag for customizable shell output format #2497 (thanks @rsleedbx)

Bumped dependencies

Changelog

Sourced from mikefarah/yq's changelog.

4.48.2:

Strip whitespace when decoding base64 #2507

Upgraded to go-yaml v4! (thanks @ccoVeille, @ingydotnet)

Add linux/loong64 to release target (thanks @znley)

Added --shell-key-separator flag for customizable shell output format #2497 (thanks @rsleedbx)

Bumped dependencies

4.48.1:

Added 'parents' operator, to return a list of all the hierarchical parents of a node

Added 'first(exp)' operator, to return the first entry matching an expression in an array

Fixed xml namespace prefixes #1730 (thanks @baodrate)

Fixed out of range panic in yaml decoder #2460 (thanks @n471d)

Bumped dependencies

4.47.2:

Conversion from TOML to JSON no longer omits empty tables #2459 (thanks @louislouislouislouis)

Bumped dependencies

4.47.1:

Fixed merge anchor behaviour (<<); #2404, #2110, #2386, #2178 Huge thanks to @stevenwdv! Note that you will need to set --yaml-fix-merge-anchor-to-spec to see the fixes

Fixed panic for syntax error when creating a map #2423

Bumped dependencies

4.46.1:

Added INI support

Fixed 'add' operator when piped in with no data #2378, #2383, #2384

Fixed delete after slice problem (bad node path) #2387 Thanks @antoinedeschenes

Fixed yq small build Thanks @imzue

Switched to YAML org supported go-yaml!

Bumped dependencies

4.45.4:

Fixing wrong map() behaviour on empty map #2359

Bumped dependencies

4.45.3:

Fixing regression introduced with in 4.45.2 with #2325 fix 😓 sorry folks!

Bumped dependencies

4.45.2:

Added windows arm builds (Thanks @albertocavalcante, @ShukantPal)

Added s390x platform support (Thanks @ashokpariya0)

Additionally push docker images to ghcr.io (Thanks @reegnz)

Fixing add when there is no node match #2325

sort_by works on maps

Bumped dependencies

4.45.1:

... (truncated)

Commits

796317b Bumping version
258b84a Strip whitespace when decoding base64 #2507
e056b91 Bump golang.org/x/net from 0.46.0 to 0.47.0
85b0985 build: add linux/loong64 to release target
874cbc4 Bump golang.org/x/text from 0.30.0 to 0.31.0
f6c780e Reverting test
8c25f33 Merge in master
2869919 Merge branch 'master' into go-yaml-v4
458d02f Bumping to go-yaml 4-rc3
877a47c Improving first op docs
Additional commits viewable in compare view

Updates github/codeql-action from 4.31.2 to 4.31.4

Release notes

Sourced from github/codeql-action's releases.

v4.31.4

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.4 - 18 Nov 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v4.31.3

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.3 - 13 Nov 2025

CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see Upcoming deprecation of CodeQL Action v3.

Update default CodeQL bundle version to 2.23.5. #3288

See the full CHANGELOG.md for more information.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.31.4 - 18 Nov 2025

No user facing changes.

4.31.3 - 13 Nov 2025

CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see Upcoming deprecation of CodeQL Action v3.

Update default CodeQL bundle version to 2.23.5. #3288

4.31.2 - 30 Oct 2025

No user facing changes.

4.31.1 - 30 Oct 2025

The add-snippets input has been removed from the analyze action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.

4.31.0 - 24 Oct 2025

Bump minimum CodeQL bundle version to 2.17.6. #3223

When SARIF files are uploaded by the analyze or upload-sarif actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the upload-sarif action. For analyze, this may affect Advanced Setup for CodeQL users who specify a value other than always for the upload input. #3222

4.30.9 - 17 Oct 2025

Update default CodeQL bundle version to 2.23.3. #3205

Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #3204

4.30.8 - 10 Oct 2025

No user facing changes.

4.30.7 - 06 Oct 2025

[v4+ only] The CodeQL Action now runs on Node.js v24. #3169

3.30.6 - 02 Oct 2025

Update default CodeQL bundle version to 2.23.2. #3168

3.30.5 - 26 Sep 2025

We fixed a bug that was introduced in 3.30.4 with upload-sarif which resulted in files without a .sarif extension not getting uploaded. #3160

... (truncated)

Commits

e12f017 Merge pull request #3312 from github/update-v4.31.4-70434f6dd
c9cb6f9 Update changelog for v4.31.4
70434f6 Merge pull request #3311 from github/mbg/deps/bump-glob
528362a Bump glob to at least 11.1.0
de12435 Merge pull request #3308 from github/mbg/pr-template/nov25
ffa63f0 Merge pull request #3307 from github/dependabot/github_actions/dot-github/wor...
7bcdb4b Add additional options to PR template and clarify some
07eae64 Merge pull request #3303 from github/mario-campos/v3-core-warning
e546fff Rebuild
c418a0f Bump ruby/setup-ruby
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

coderabbitai · 2025-11-21T05:25:26Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

…tory with 6 updates Bumps the github-action-dependencies group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `5.0.0` | `6.0.0` | | [elgohr/Publish-Docker-Github-Action](https://github.com/elgohr/publish-docker-github-action) | `1d95820b6952cab6e48a2454ff6ca9804bf65f31` | `15cc35eb4da44fc6b93b817f1e1a5f01b5456e50` | | [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `8.0.0` | `9.0.0` | | [svenstaro/upload-release-action](https://github.com/svenstaro/upload-release-action) | `2.11.2` | `2.11.3` | | [mikefarah/yq](https://github.com/mikefarah/yq) | `4.48.1` | `4.48.2` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.31.2` | `4.31.4` | Updates `actions/checkout` from 5.0.0 to 6.0.0 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@08c6903...1af3b93) Updates `elgohr/Publish-Docker-Github-Action` from 1d95820b6952cab6e48a2454ff6ca9804bf65f31 to 15cc35eb4da44fc6b93b817f1e1a5f01b5456e50 - [Release notes](https://github.com/elgohr/publish-docker-github-action/releases) - [Commits](elgohr/Publish-Docker-Github-Action@1d95820...15cc35e) Updates `golangci/golangci-lint-action` from 8.0.0 to 9.0.0 - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@4afd733...0a35821) Updates `svenstaro/upload-release-action` from 2.11.2 to 2.11.3 - [Release notes](https://github.com/svenstaro/upload-release-action/releases) - [Changelog](https://github.com/svenstaro/upload-release-action/blob/master/CHANGELOG.md) - [Commits](svenstaro/upload-release-action@81c65b7...6b7fa9f) Updates `mikefarah/yq` from 4.48.1 to 4.48.2 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@0ecdce2...796317b) Updates `github/codeql-action` from 4.31.2 to 4.31.4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@0499de3...e12f017) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-action-dependencies - dependency-name: elgohr/Publish-Docker-Github-Action dependency-version: 15cc35eb4da44fc6b93b817f1e1a5f01b5456e50 dependency-type: direct:production dependency-group: github-action-dependencies - dependency-name: golangci/golangci-lint-action dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-action-dependencies - dependency-name: svenstaro/upload-release-action dependency-version: 2.11.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-action-dependencies - dependency-name: mikefarah/yq dependency-version: 4.48.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-action-dependencies - dependency-name: github/codeql-action dependency-version: 4.31.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-action-dependencies ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot · 2025-11-25T05:24:50Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot bot added dependencies github_actions Pull requests that update GitHub Actions code labels Nov 21, 2025

dependabot bot force-pushed the dependabot/github_actions/github-action-dependencies-9fb110eac9 branch from c9455fe to ca042e0 Compare November 24, 2025 05:28

dependabot bot closed this Nov 25, 2025

dependabot bot deleted the dependabot/github_actions/github-action-dependencies-9fb110eac9 branch November 25, 2025 05:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the github-action-dependencies group across 1 directory with 6 updates #1734

chore(deps): bump the github-action-dependencies group across 1 directory with 6 updates #1734

Uh oh!

dependabot bot commented on behalf of github Nov 21, 2025 •

edited

Loading

Uh oh!

coderabbitai bot commented Nov 21, 2025

Review skipped

Uh oh!

dependabot bot commented on behalf of github Nov 25, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chore(deps): bump the github-action-dependencies group across 1 directory with 6 updates #1734

chore(deps): bump the github-action-dependencies group across 1 directory with 6 updates #1734

Uh oh!

Conversation

dependabot bot commented on behalf of github Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v6.0.0

What's Changed

v6-beta

What's Changed

v5.0.1

What's Changed

Changelog

V6.0.0

V5.0.1

V5.0.0

V4.3.1

V4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v4.1.5

v9.0.0

What's Changed

Changes

2.11.3

Changelog

[2.11.3] - 2025-11-20

[2.11.2] - 2025-07-06

[2.11.1] - 2025-06-30

[2.10.0] - 2025-06-21

[2.9.1] - 2025-06-21

[2.9.0] - 2024-02-22

[2.8.0] - 2024-02-21

[2.7.0] - 2023-07-28

[2.6.1] - 2023-05-31

[2.6.0] - 2023-05-23

[2.5.0] - 2023-02-21

[2.4.1] - 2023-02-01

[2.4.0] - 2023-01-09

[2.3.0] - 2022-06-05

v4.48.2

v4.31.4

CodeQL Action Changelog

4.31.4 - 18 Nov 2025

v4.31.3

CodeQL Action Changelog

4.31.3 - 13 Nov 2025

CodeQL Action Changelog

[UNRELEASED]

4.31.4 - 18 Nov 2025

4.31.3 - 13 Nov 2025

4.31.2 - 30 Oct 2025

4.31.1 - 30 Oct 2025

4.31.0 - 24 Oct 2025

4.30.9 - 17 Oct 2025

4.30.8 - 10 Oct 2025

4.30.7 - 06 Oct 2025

3.30.6 - 02 Oct 2025

3.30.5 - 26 Sep 2025

Uh oh!

coderabbitai bot commented Nov 21, 2025

Review skipped

Uh oh!

dependabot bot commented on behalf of github Nov 25, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot bot commented on behalf of github Nov 21, 2025 •

edited

Loading