Skip to content

chore: bump the github-actions group across 1 directory with 8 updates#711

Merged
jkjell merged 1 commit intomainfrom
dependabot/github_actions/github-actions-b2ec3e7642
Feb 13, 2026
Merged

chore: bump the github-actions group across 1 directory with 8 updates#711
jkjell merged 1 commit intomainfrom
dependabot/github_actions/github-actions-b2ec3e7642

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Feb 9, 2026

Bumps the github-actions group with 8 updates in the / directory:

Package From To
step-security/harden-runner 2.14.0 2.14.2
actions/checkout 6.0.1 6.0.2
actions/setup-go 6.1.0 6.2.0
github/codeql-action 4.31.10 4.32.2
fossas/fossa-action 1.7.0 1.8.0
docker/login-action 3.6.0 3.7.0
actions/setup-python 6.1.0 6.2.0
peter-evans/create-pull-request 8.0.0 8.1.0

Updates step-security/harden-runner from 2.14.0 to 2.14.2

Release notes

Sourced from step-security/harden-runner's releases.

v2.14.2

What's Changed

Security fix: Fixed a medium severity vulnerability where outbound network connections using sendto, sendmsg, and sendmmsg socket system calls could bypass audit logging when using egress-policy: audit. This issue only affects the Community Tier in audit mode; block mode and Enterprise Tier were not affected. See GHSA-cpmj-h4f6-r6pq for details.

Full Changelog: step-security/harden-runner@v2.14.1...v2.14.2

v2.14.1

What's Changed

  1. In some self-hosted environments, the agent could briefly fall back to public DNS resolvers during startup if the system DNS was not yet available. This behavior was unintended for GitHub-hosted runners and has now been fixed to prevent any use of public DNS resolvers.

  2. Fixed npm audit vulnerabilities

Full Changelog: step-security/harden-runner@v2.14.0...v2.14.1

Commits

Updates actions/checkout from 6.0.1 to 6.0.2

Release notes

Sourced from actions/checkout's releases.

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

... (truncated)

Commits
  • de0fac2 Fix tag handling: preserve annotations and explicit fetch-tags (#2356)
  • 064fe7f Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...
  • See full diff in compare view

Updates actions/setup-go from 6.1.0 to 6.2.0

Release notes

Sourced from actions/setup-go's releases.

v6.2.0

What's Changed

Enhancements

Dependency updates

New Contributors

Full Changelog: actions/setup-go@v6...v6.2.0

Commits

Updates github/codeql-action from 4.31.10 to 4.32.2

Release notes

Sourced from github/codeql-action's releases.

v4.32.2

  • Update default CodeQL bundle version to 2.24.1. #3460

v4.32.1

  • A warning is now shown in Default Setup workflow logs if a private package registry is configured using a GitHub Personal Access Token (PAT), but no username is configured. #3422
  • Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. #3421

v4.32.0

  • Update default CodeQL bundle version to 2.24.0. #3425

v4.31.11

  • When running a Default Setup workflow with Actions debugging enabled, the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. #3409
  • Improved error handling throughout the CodeQL Action. #3415
  • Added experimental support for automatically excluding generated files from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. #3318
  • The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. #3403
Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.32.2 - 05 Feb 2026

  • Update default CodeQL bundle version to 2.24.1. #3460

4.32.1 - 02 Feb 2026

  • A warning is now shown in Default Setup workflow logs if a private package registry is configured using a GitHub Personal Access Token (PAT), but no username is configured. #3422
  • Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. #3421

4.32.0 - 26 Jan 2026

  • Update default CodeQL bundle version to 2.24.0. #3425

4.31.11 - 23 Jan 2026

  • When running a Default Setup workflow with Actions debugging enabled, the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. #3409
  • Improved error handling throughout the CodeQL Action. #3415
  • Added experimental support for automatically excluding generated files from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. #3318
  • The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. #3403

4.31.10 - 12 Jan 2026

  • Update default CodeQL bundle version to 2.23.9. #3393

4.31.9 - 16 Dec 2025

No user facing changes.

4.31.8 - 11 Dec 2025

  • Update default CodeQL bundle version to 2.23.8. #3354

4.31.7 - 05 Dec 2025

  • Update default CodeQL bundle version to 2.23.7. #3343

4.31.6 - 01 Dec 2025

No user facing changes.

4.31.5 - 24 Nov 2025

... (truncated)

Commits
  • 45cbd0c Merge pull request #3461 from github/update-v4.32.2-7aee93297
  • cb528be Update changelog for v4.32.2
  • 7aee932 Merge pull request #3460 from github/update-bundle/codeql-bundle-v2.24.1
  • b5f028a Merge pull request #3457 from github/dependabot/npm_and_yarn/npm-minor-4c1fc3...
  • 9702c27 Merge branch 'main' into dependabot/npm_and_yarn/npm-minor-4c1fc3d0aa
  • c36c948 Add changelog note
  • 3d03318 Update default bundle to codeql-bundle-v2.24.1
  • 77591e2 Merge pull request #3459 from github/copilot/fix-github-actions-workflow-again
  • 7a44a9d Fix Rebuild Action workflow by adding --no-edit flag to git merge --continue
  • e2ac371 Initial plan
  • Additional commits viewable in compare view

Updates fossas/fossa-action from 1.7.0 to 1.8.0

Commits
  • c414b9a Pin version opt (#266)
  • ba7c3df Bump @​actions/core from 2.0.1 to 2.0.2 (#263)
  • c95b9b8 Bump @​actions/tool-cache from 2.0.2 to 3.0.0 (#262)
  • 76d09c3 Bump globals from 16.5.0 to 17.0.0 (#260)
  • 9f3e862 Bump @​typescript-eslint/parser from 8.48.0 to 8.52.0 (#257)
  • c01ee11 Bump @​types/node from 24.10.1 to 25.0.3 (#258)
  • 2317073 Bump @​actions/core from 1.11.1 to 2.0.1 (#256)
  • 47e4002 Bump @​actions/exec from 1.1.1 to 2.0.0 (#252)
  • 7f84733 Bump @​eslint/eslintrc from 3.3.1 to 3.3.3 (#248)
  • c09a922 Bump @​typescript-eslint/parser from 8.46.2 to 8.48.0 (#246)
  • Additional commits viewable in compare view

Updates docker/login-action from 3.6.0 to 3.7.0

Release notes

Sourced from docker/login-action's releases.

v3.7.0

Full Changelog: docker/login-action@v3.6.0...v3.7.0

Commits
  • c94ce9f Merge pull request #915 from docker/dependabot/npm_and_yarn/lodash-4.17.23
  • 8339c95 Merge pull request #912 from docker/scope
  • c83e932 build(deps): bump lodash from 4.17.21 to 4.17.23
  • b268aa5 chore: update generated content
  • a603229 documentation for scope input
  • 7567f92 Add scope input to set scopes for the authentication token
  • 0567fa5 Merge pull request #914 from dphi/add-support-for-amazonaws.eu
  • f6ef577 feat: add support for AWS European Sovereign Cloud ECR registries
  • 916386b Merge pull request #911 from crazy-max/ensure-redact
  • 5b3f94a chore: update generated content
  • Additional commits viewable in compare view

Updates actions/setup-python from 6.1.0 to 6.2.0

Release notes

Sourced from actions/setup-python's releases.

v6.2.0

What's Changed

Dependency Upgrades

Full Changelog: actions/setup-python@v6...v6.2.0

Commits

Updates peter-evans/create-pull-request from 8.0.0 to 8.1.0

Release notes

Sourced from peter-evans/create-pull-request's releases.

Create Pull Request v8.1.0

What's Changed

New Contributors

Full Changelog: peter-evans/create-pull-request@v8.0.0...v8.1.0

Commits
  • c0f553f feat: add @​octokit/plugin-retry to handle retriable server errors (#4298)
  • 7000124 fix: Handle remote prune failures gracefully (#4295)
  • 34aa40e build: update distribution (#4289)
  • 641099d build(deps-dev): bump undici from 6.22.0 to 6.23.0 (#4284)
  • 2271f1d build(deps-dev): bump the npm group with 2 updates (#4274)
  • 437c31a build(deps): bump the github-actions group with 2 updates (#4273)
  • 0979079 docs: update readme
  • 5b751cd README.md: bump given GitHub actions to their latest versions (#4265)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Feb 9, 2026
@dependabot @jkjell
chore: bump the github-actions group across 1 directory with 8 updates
dfbab72 
Bumps the github-actions group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.14.0` | `2.14.2` |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.1` | `6.0.2` |
| [actions/setup-go](https://github.com/actions/setup-go) | `6.1.0` | `6.2.0` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.31.10` | `4.32.2` |
| [fossas/fossa-action](https://github.com/fossas/fossa-action) | `1.7.0` | `1.8.0` |
| [docker/login-action](https://github.com/docker/login-action) | `3.6.0` | `3.7.0` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.1.0` | `6.2.0` |
| [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `8.0.0` | `8.1.0` |



Updates `step-security/harden-runner` from 2.14.0 to 2.14.2
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@20cf305...5ef0c07)

Updates `actions/checkout` from 6.0.1 to 6.0.2
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@8e8c483...de0fac2)

Updates `actions/setup-go` from 6.1.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@4dc6199...7a3fe6c)

Updates `github/codeql-action` from 4.31.10 to 4.32.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdefb33...45cbd0c)

Updates `fossas/fossa-action` from 1.7.0 to 1.8.0
- [Release notes](https://github.com/fossas/fossa-action/releases)
- [Commits](fossas/fossa-action@3ebcea1...c414b9a)

Updates `docker/login-action` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)

Updates `actions/setup-python` from 6.1.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@83679a8...a309ff8)

Updates `peter-evans/create-pull-request` from 8.0.0 to 8.1.0
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](peter-evans/create-pull-request@98357b1...c0f553f)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/setup-go
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action
  dependency-version: 4.32.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: fossas/fossa-action
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/login-action
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: peter-evans/create-pull-request
  dependency-version: 8.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@jkjell jkjell force-pushed the dependabot/github_actions/github-actions-b2ec3e7642 branch from 8f010c6 to dfbab72 Compare February 13, 2026 02:11
@jkjell jkjell merged commit 53700c5 into main Feb 13, 2026
12 checks passed
@jkjell jkjell deleted the dependabot/github_actions/github-actions-b2ec3e7642 branch February 13, 2026 02:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jkjell jkjell jkjell approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jkjell