Skip to content

Bump the all-actions group across 1 directory with 4 updates#415

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/all-actions-d850e79cd2
Open

Bump the all-actions group across 1 directory with 4 updates#415
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/all-actions-d850e79cd2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 22, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-actions group with 4 updates in the / directory: actions/setup-node, advanced-security/reusable-workflows/.github/workflows/codeql-ql.yml, advanced-security/codeql-development-mcp-server/.github/actions/setup-codeql-environment and softprops/action-gh-release.

Updates actions/setup-node from 6.4.0 to 7.0.0

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits
  • 8207627 Migrate to ESM and upgrade dependencies (#1574)
  • 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
  • 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
  • 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
  • 30eb73b Resolve high-severity audit issues
  • 4e1a87a Update dist
  • 360237f Strict equality
  • 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
  • f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
  • 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
  • Additional commits viewable in compare view

Updates advanced-security/reusable-workflows/.github/workflows/codeql-ql.yml from 2028787a231ffa7d5445cfbf3d63db40b6131489 to cdb58ebdac3e974822957b34c90394db7dd44ccc

Commits
  • cdb58eb Bump version from 0.3.4 to 0.3.5
  • 3076113 Downgrade patch-release-me action to version 0.6.5
  • eb3ac79 [WIP] Fix failing GitHub Actions job 'fetch-release' (#104)
  • 10f3968 Update Patch Release Me action version to 0.6.6
  • 3c60b2a deps: bump the actions group with 6 updates (#103)
  • b23fbd9 Fix markdown-lint workflow: replace markdownlint (library) with `markdownli...
  • 2c906a7 chore(deps): bump markdown-it (#99)
  • 527b55d deps: bump the actions group across 1 directory with 6 updates (#100)
  • See full diff in compare view

Updates advanced-security/codeql-development-mcp-server/.github/actions/setup-codeql-environment from 2.25.6 to 2.26.0

Release notes

Sourced from advanced-security/codeql-development-mcp-server/.github/actions/setup-codeql-environment's releases.

v2.26.0

What's Changed

New Contributors

Full Changelog: advanced-security/codeql-development-mcp-server@v2.25.6...v2.26.0

Changelog

Sourced from advanced-security/codeql-development-mcp-server/.github/actions/setup-codeql-environment's changelog.

Changelog

All notable changes to the CodeQL Development MCP Server are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning aligned with the CodeQL CLI release cadence.

Scope: Only stable (non-pre-release, non-RC) tagged versions are listed. Pre-release and release-candidate tags (e.g., v2.25.0-rc1) are omitted.

[Unreleased]

Changes on main since the latest tagged release that have not yet been included in a stable release.

[v2.26.1] — 2026-07-17

Highlights

  • Upgraded CodeQL CLI to v2.26.1 — All bundled CodeQL tool query packs were re-resolved against the v2.26.1 library set (actions-all 0.4.39, cpp-all 12.0.0, csharp-all 7.1.0, go-all 7.2.1, java-all 9.2.1, javascript-all 2.8.1, python-all 7.2.1, ruby-all 6.0.1, rust-all 0.2.17, swift-all 6.7.2), and every language's query unit tests pass under the new CLI. (#314)
  • Ruby and Rust tool packs are back on their latest upstream library sets — The codeql/namebinding dependency that blocked the ruby-all and rust-all upgrades in v2.26.0 is now published to the public GitHub Container Registry, so both packs move off their pinned versions (ruby-all 5.2.2 → 6.0.1, rust-all 0.2.15 → 0.2.17) and compile and test cleanly under 2.26.1. (#314)

Fixed

  • Ruby PrintAST and PrintCFG unit tests failed after the ruby-all 6.0.1 upgrade. Regenerated the ruby PrintAST.expected and PrintCFG.expected baselines to match the output produced by the new library set under CLI 2.26.1. (#314)

Dependencies

  • Upgraded the CodeQL CLI dependency to v2.26.1. All version-bearing files (.codeql-version, the root/server/extension package.json files, the per-language codeql-pack.yml manifests, and the server VERSION constant) and the codeql-pack.lock.yml lock files were updated. (#314)
  • Bumped the Go MCP client dependency github.com/mark3labs/mcp-go from 0.55.1 to 0.56.0. (#313)

Full Changelog: v2.26.0...v2.26.1

[v2.26.0] — 2026-07-08

Highlights

  • Upgraded CodeQL CLI to v2.26.0 — All bundled CodeQL tool query packs were re-resolved against the v2.26.0 library set (actions-all 0.4.38, cpp-all 11.0.0, csharp-all 7.0.0, go-all 7.2.0, java-all 9.2.0, javascript-all 2.8.0, python-all 7.2.0, swift-all 6.7.1), and every language's query unit tests pass under the new CLI. The Ruby and Rust tool packs are intentionally held at their last-compatible library versions (ruby-all 5.2.2, rust-all 0.2.15): the upstream ruby-all 6.0.0 and rust-all 0.2.16 releases for CLI 2.26.0 declare a dependency on codeql/namebinding, which is not yet published to the public GitHub Container Registry and therefore cannot be resolved. The pinned versions still compile and test cleanly under 2.26.0 and will be re-upgraded once codeql/namebinding is available.
  • Second supply-chain hardening pass for release workflows — All release-generating workflows now opt out of every cache step, pin runners, strictly validate version inputs, and refuse mid-publish cancellation. See Security below for the full inventory. (#279)
  • First-class Rust toolchain support in CI — setup-codeql-environment now installs a pinned Rust toolchain (default 1.80.0, via a pinned dtolnay/rust-toolchain action with rust-src) for any matrix entry that includes rust, so the CodeQL rust extractor can expand format! / println! / vec! macros against the standard library on Linux runners. The query-unit-tests.yml workflow now passes languages: ${{ matrix.language }} so each matrix entry only installs its own runtime. (#279)
  • Diff-informed analysis & overlay database support — New MCP primitives help developers make data-flow queries diff-informed (incremental) and build/evaluate overlay databases. A new diff_informed_analysis_workflow prompt and two reference resources walk through the query-side opt-in (observeDiffInformedIncrementalMode, getASelectedSourceLocation, getASelectedSinkLocation) and validation via codeql test run --check-diff-informed, while codeql_database_create, codeql_database_analyze, codeql_query_run, and codeql_test_run gained the corresponding advanced/experimental CLI parameters. (#304)
  • Client-free, server-and-extension-only VSIX build — Organizations that mirror the MCP server and VS Code extension packages in their own internal registries can now build and package a VSIX with no dependency on the Go client/ (which the recent conversion of client/** to Go otherwise pulled into the default npm run build). A new build:server-and-extension root script, combined with the existing package:vsix, provides a clean install → build → package path (npm install → npm run build:server-and-extension → npm run package:vsix) that never invokes the Go toolchain. (#309)

Added

MCP Server Prompts

... (truncated)

Commits
  • 65a6c42 Prepare v2.26.0 release (CodeQL CLI 2.26.0) (#312)
  • 8bbfe76 Build(deps): bump the all-github-actions group with 3 updates (#311)
  • 9a91411 Build(deps): bump github.com/mark3labs/mcp-go (#310)
  • 5fc9a89 Prepare v2.25.6-next.1 prerelease with client-free VSIX build (#309)
  • 85d532a Implement multi-root CodeQL query resolution with workspace support (#308)
  • e8dc241 Build(deps): bump github.com/mark3labs/mcp-go (#306)
  • 5f9ea8e chore(deps): bump pinned actions, add Dependabot cooldown (#305)
  • 39f1d49 feat(server): add diff-informed & overlay analysis ql-mcp primitives (#304)
  • 27fee42 Build(deps-dev): bump esbuild from 0.28.0 to 0.28.1 (#293)
  • 3352b51 Build(deps-dev): bump form-data from 4.0.5 to 4.0.6 (#296)
  • Additional commits viewable in compare view

Updates softprops/action-gh-release from 3.0.1 to 3.0.2

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.2

3.0.2 is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since 3.0.1.

This release fixes #795, #438, and #803. The upload transport hardening covers the historical failure reported in #790, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to #786 and does not claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

Bug fixes 🐛

Other Changes 🔄

Changelog

Sourced from softprops/action-gh-release's changelog.

3.0.2

3.0.2 is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since 3.0.1.

This release fixes #795, #438, and #803. The upload transport hardening covers the historical failure reported in #790, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to #786 and does not claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

Bug fixes 🐛

Other Changes 🔄

3.0.1

  • maintenance release with updated dependencies

3.0.0

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24. Use v3 on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. v2.6.2 was the final Node 20-compatible release and is no longer maintained or supported.

What's Changed

Other Changes 🔄

  • Move the action runtime and bundle target to Node 24
  • Update @types/node to the Node 24 line and allow future Dependabot updates
  • Keep the floating major tag on v3; freeze v2 at the final v2.6.2 release

... (truncated)

Commits
  • 3d0d988 release 3.0.2 (#818)
  • 7e13ed4 fix: clarify release creation 404 errors (#817)
  • e6c70a5 fix: replace existing release assets on Gitea (#816)
  • f345337 fix: publish existing draft releases as prereleases (#801)
  • d8a89a2 fix: upload small checksum assets reliably (#815)
  • 45ece40 chore(deps): remove unused TypeScript tooling (#814)
  • f6b913c feat: improve release error reporting and test coverage (#813)
  • 15f193d chore(deps): upgrade TypeScript to 7 (#812)
  • cc8268d chore(deps): bump actions/checkout in the github-actions group (#810)
  • fd0ed1e chore(deps): bump the npm group with 3 updates (#811)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the all-actions group across 1 directory with 4 updates
787b628 
Bumps the all-actions group with 4 updates in the / directory: [actions/setup-node](https://github.com/actions/setup-node), [advanced-security/reusable-workflows/.github/workflows/codeql-ql.yml](https://github.com/advanced-security/reusable-workflows), [advanced-security/codeql-development-mcp-server/.github/actions/setup-codeql-environment](https://github.com/advanced-security/codeql-development-mcp-server) and [softprops/action-gh-release](https://github.com/softprops/action-gh-release).


Updates `actions/setup-node` from 6.4.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@48b55a0...8207627)

Updates `advanced-security/reusable-workflows/.github/workflows/codeql-ql.yml` from 2028787a231ffa7d5445cfbf3d63db40b6131489 to cdb58ebdac3e974822957b34c90394db7dd44ccc
- [Release notes](https://github.com/advanced-security/reusable-workflows/releases)
- [Commits](advanced-security/reusable-workflows@2028787...cdb58eb)

Updates `advanced-security/codeql-development-mcp-server/.github/actions/setup-codeql-environment` from 2.25.6 to 2.26.0
- [Release notes](https://github.com/advanced-security/codeql-development-mcp-server/releases)
- [Changelog](https://github.com/advanced-security/codeql-development-mcp-server/blob/main/CHANGELOG.md)
- [Commits](advanced-security/codeql-development-mcp-server@b3a4b77...65a6c42)

Updates `softprops/action-gh-release` from 3.0.1 to 3.0.2
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@718ea10...3d0d988)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-actions
- dependency-name: advanced-security/reusable-workflows/.github/workflows/codeql-ql.yml
  dependency-version: cdb58ebdac3e974822957b34c90394db7dd44ccc
  dependency-type: direct:production
  dependency-group: all-actions
- dependency-name: advanced-security/codeql-development-mcp-server/.github/actions/setup-codeql-environment
  dependency-version: 2.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-actions
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants