Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 5, 2025

Bumps the all-actions group with 5 updates in the / directory:

Package From To
reviewdog/action-actionlint 1.68.0 1.69.1
reviewdog/action-shellcheck 1.9.0 1.32.0
marocchino/sticky-pull-request-comment 2.9.1 2.9.4
github/codeql-action 4.31.4 4.31.6
actions/stale 10.1.0 10.1.1

Updates reviewdog/action-actionlint from 1.68.0 to 1.69.1

Release notes

Sourced from reviewdog/action-actionlint's releases.

Release v1.69.1

v1.69.1: PR #185 - feat: update action.yml

Release v1.69.0

v1.69.0: PR #183 - chore(deps): update actionlint to 1.7.9

Commits
  • 83e4ed2 bump v1.69.1
  • 651f708 Merge branch 'main' into releases/v1
  • 44b7d68 Merge pull request #185 from vvanouytsel/patch-1
  • 89ed127 feat: update action.yml
  • 437bbe9 bump v1.69.0
  • 54e9dc8 Merge branch 'main' into releases/v1
  • 1e0347f Merge pull request #183 from reviewdog/depup/actionlint
  • 63e99e6 Merge pull request #182 from reviewdog/renovate/actions-checkout-6.x
  • 9947a32 Merge pull request #179 from reviewdog/renovate/shogo82148-actions-create-rel...
  • 86dee71 Merge pull request #184 from reviewdog/renovate/peter-evans-create-pull-reque...
  • Additional commits viewable in compare view

Updates reviewdog/action-shellcheck from 1.9.0 to 1.32.0

Release notes

Sourced from reviewdog/action-shellcheck's releases.

Release v1.32.0

What's Changed

Full Changelog: reviewdog/action-shellcheck@v1.31.0...v1.32.0

Release v1.31.0

What's Changed

Full Changelog: reviewdog/action-shellcheck@v1.30.0...v1.31.0

Release v1.30.0

What's Changed

New Contributors

Full Changelog: reviewdog/action-shellcheck@v1.29.3...v1.30.0

Release v1.29.3

What's Changed

Full Changelog: reviewdog/action-shellcheck@v1.29.2...v1.29.3

Release v1.29.2

What's Changed

Full Changelog: reviewdog/action-shellcheck@v1.29.1...v1.29.2

Release v1.29.1

What's Changed

Full Changelog: reviewdog/action-shellcheck@v1.29.0...v1.29.1

Release v1.29.0

... (truncated)

Commits
  • 4c07458 Merge pull request #88 from reviewdog/depup/reviewdog/reviewdog
  • e410e3c Merge pull request #89 from reviewdog/renovate/reviewdog-action-setup-1.x
  • e9b97d8 Merge pull request #83 from reviewdog/renovate/haya14busa-action-update-semve...
  • c92763a Merge pull request #82 from reviewdog/renovate/haya14busa-action-bumpr-1.x
  • d4dfa7a chore(deps): update reviewdog/action-setup action to v1.4.0
  • 7e730f8 chore(deps): update reviewdog/reviewdog to 0.21.0
  • 7987798 chore(deps): update haya14busa/action-update-semver action to v1.3.0
  • 1265a1d chore(deps): update haya14busa/action-bumpr action to v1.11.4
  • 1bb9751 Merge pull request #85 from reviewdog/depup/koalaman/shellcheck
  • b93e052 chore(deps): update koalaman/shellcheck to 0.11.0
  • Additional commits viewable in compare view

Updates marocchino/sticky-pull-request-comment from 2.9.1 to 2.9.4

Release notes

Sourced from marocchino/sticky-pull-request-comment's releases.

v2.9.4

What's Changed

Full Changelog: marocchino/sticky-pull-request-comment@v2.9.3...v2.9.4

v2.9.3

What's Changed

  • Update deps (including security issues)
  • Test with vitest instead of jest
  • Use biome

Full Changelog: marocchino/sticky-pull-request-comment@v2.9.2...v2.9.3

v2.9.2

What's Changed

Full Changelog: marocchino/sticky-pull-request-comment@v2.9.1...v2.9.2

Commits
  • 7737449 📦️ Build
  • 8b423c6 Merge pull request #1564 from marocchino/dependabot/npm_and_yarn/types/node-2...
  • 3ac8a74 build(deps-dev): Bump @​types/node from 24.0.12 to 24.0.13
  • e430cfc Merge pull request #1563 from marocchino/dependabot/npm_and_yarn/types/node-2...
  • 99f9378 build(deps-dev): Bump @​types/node from 24.0.11 to 24.0.12
  • 2216b3a Merge pull request #1562 from marocchino/dependabot/npm_and_yarn/biomejs/biom...
  • 482d7fd build(deps-dev): Bump @​biomejs/biome from 2.0.4 to 2.1.1
  • c2da581 Merge pull request #1561 from marocchino/dependabot/npm_and_yarn/types/node-2...
  • 76f8462 build(deps-dev): Bump @​types/node from 24.0.3 to 24.0.11
  • 246151a ⬆️ Update biome
  • Additional commits viewable in compare view

Updates github/codeql-action from 4.31.4 to 4.31.6

Release notes

Sourced from github/codeql-action's releases.

v4.31.6

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.6 - 01 Dec 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v4.31.5

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.5 - 24 Nov 2025

  • Update default CodeQL bundle version to 2.23.6. #3321

See the full CHANGELOG.md for more information.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.31.6 - 01 Dec 2025

No user facing changes.

4.31.5 - 24 Nov 2025

  • Update default CodeQL bundle version to 2.23.6. #3321

4.31.4 - 18 Nov 2025

No user facing changes.

4.31.3 - 13 Nov 2025

  • CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see Upcoming deprecation of CodeQL Action v3.
  • Update default CodeQL bundle version to 2.23.5. #3288

4.31.2 - 30 Oct 2025

No user facing changes.

4.31.1 - 30 Oct 2025

  • The add-snippets input has been removed from the analyze action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.

4.31.0 - 24 Oct 2025

  • Bump minimum CodeQL bundle version to 2.17.6. #3223
  • When SARIF files are uploaded by the analyze or upload-sarif actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the upload-sarif action. For analyze, this may affect Advanced Setup for CodeQL users who specify a value other than always for the upload input. #3222

4.30.9 - 17 Oct 2025

  • Update default CodeQL bundle version to 2.23.3. #3205
  • Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #3204

4.30.8 - 10 Oct 2025

No user facing changes.

4.30.7 - 06 Oct 2025

  • [v4+ only] The CodeQL Action now runs on Node.js v24. #3169

... (truncated)

Commits
  • fe4161a Merge pull request #3336 from github/update-v4.31.6-ecec1f887
  • 88c2ab5 Update changelog for v4.31.6
  • ecec1f8 Merge pull request #3335 from github/mbg/ci/run-codeql-on-all-prs
  • 23da732 Merge pull request #3334 from github/kaspersv/overlay-minor-comments
  • f7abc74 Remove branch filter for PR event in CodeQL workflow
  • 32ada5e Merge branch 'main' into kaspersv/overlay-minor-comments
  • 75b2f49 Merge pull request #3333 from github/kaspersv/overlay-no-resource-checks-option
  • f036b1c Merge branch 'main' into kaspersv/overlay-no-resource-checks-option
  • 58c5954 Add comment to runnerSupportsOverlayAnalysis
  • b02fa13 Order feature flags alphabetically
  • Additional commits viewable in compare view

Updates actions/stale from 10.1.0 to 10.1.1

Release notes

Sourced from actions/stale's releases.

v10.1.1

What's Changed

Bug Fix

Improvement

Dependency Upgrades

New Contributors

Full Changelog: actions/stale@v10...v10.1.1

Commits
  • 9971854 build(deps): bump actions/checkout from 4 to 6 (#1306)
  • 5611b9d build(deps): bump actions/publish-action from 0.3.0 to 0.4.0 (#1291)
  • fad0de8 Improves error handling when rate limiting is disabled on GHES. (#1300)
  • 39bea7d Add Missing Input Reading for only-issue-types (#1298)
  • e46bbab build(deps-dev): bump @​types/node from 20.10.3 to 24.2.0 and document breakin...
  • 65d1d48 build(deps-dev): bump eslint-config-prettier from 8.10.0 to 10.1.8 (#1276)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Dec 5, 2025
@dependabot dependabot bot requested a review from yacosta738 as a code owner December 5, 2025 06:16
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Dec 5, 2025
@cloudflare-workers-and-pages
Copy link

cloudflare-workers-and-pages bot commented Dec 5, 2025

Deploying cvix with  Cloudflare Pages  Cloudflare Pages

Latest commit: 2dd9be7
Status: ✅  Deploy successful!
Preview URL: https://09db0174.cvix.pages.dev
Branch Preview URL: https://dependabot-github-actions-al-07fq.cvix.pages.dev

View logs

@dependabot dependabot bot added the github_actions Pull requests that update GitHub Actions code label Dec 5, 2025
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Dec 5, 2025

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.


Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions github-actions bot added area:ci Continuous integration or GitHub Actions changes type:chore Code maintenance and configuration changes labels Dec 5, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Dec 5, 2025

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
actions/actions/stale 997185467fa4f803885201cee163a9f38240193d 🟢 5.5
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Maintained🟢 57 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Vulnerabilities🟢 64 existing vulnerabilities detected
SAST🟢 6SAST tool is not run on all commits -- score normalized to 6

Scanned Files

  • .github/workflows/stale.yml

@github-actions
Copy link
Contributor

github-actions bot commented Dec 5, 2025

Test Results

163 files  163 suites   1m 14s ⏱️
680 tests 680 ✅ 0 💤 0 ❌
684 runs  684 ✅ 0 💤 0 ❌

Results for commit 2dd9be7.

♻️ This comment has been updated with latest results.

@dependabot dependabot bot force-pushed the dependabot/github_actions/all-actions-0c64c0dc60 branch 3 times, most recently from bebf8c9 to 2b8444a Compare December 5, 2025 18:41
…ates

Bumps the all-actions group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [reviewdog/action-actionlint](https://github.com/reviewdog/action-actionlint) | `1.68.0` | `1.69.1` |
| [reviewdog/action-shellcheck](https://github.com/reviewdog/action-shellcheck) | `1.9.0` | `1.32.0` |
| [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment) | `2.9.1` | `2.9.4` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.31.4` | `4.31.6` |
| [actions/stale](https://github.com/actions/stale) | `10.1.0` | `10.1.1` |



Updates `reviewdog/action-actionlint` from 1.68.0 to 1.69.1
- [Release notes](https://github.com/reviewdog/action-actionlint/releases)
- [Commits](reviewdog/action-actionlint@f00ad06...83e4ed2)

Updates `reviewdog/action-shellcheck` from 1.9.0 to 1.32.0
- [Release notes](https://github.com/reviewdog/action-shellcheck/releases)
- [Commits](reviewdog/action-shellcheck@f627b97...4c07458)

Updates `marocchino/sticky-pull-request-comment` from 2.9.1 to 2.9.4
- [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases)
- [Commits](marocchino/sticky-pull-request-comment@v2.9.1...7737449)

Updates `github/codeql-action` from 4.31.4 to 4.31.6
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@e12f017...fe4161a)

Updates `actions/stale` from 10.1.0 to 10.1.1
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@5f858e3...9971854)

---
updated-dependencies:
- dependency-name: reviewdog/action-actionlint
  dependency-version: 1.69.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-actions
- dependency-name: reviewdog/action-shellcheck
  dependency-version: 1.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-actions
- dependency-name: marocchino/sticky-pull-request-comment
  dependency-version: 2.9.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-actions
- dependency-name: github/codeql-action
  dependency-version: 4.31.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-actions
- dependency-name: actions/stale
  dependency-version: 10.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-actions
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/github_actions/all-actions-0c64c0dc60 branch from 2b8444a to 2dd9be7 Compare December 5, 2025 20:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:ci Continuous integration or GitHub Actions changes dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code type:chore Code maintenance and configuration changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant