Skip to content

ci(deps): bump the all group across 1 directory with 14 updates #7751

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

ci(deps): bump the all group across 1 directory with 14 updates #7751

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 1, 2025 •
edited
Loading

Bumps the all group with 14 updates in the / directory:

Package From To
actions/checkout 4.2.2 5.0.0
actions/setup-go 5 6
actions/download-artifact 4.1.3 5.0.0
actions/cache 4.2.3 4.3.0
actions/setup-python 5 6
securego/gosec 2.22.5 2.22.9
actions/setup-node 4 5
checkmarx/kics-github-action 2.1.13 2.1.14
docker/login-action 3.4.0 3.6.0
docker/metadata-action 5.7.0 5.8.0
goreleaser/goreleaser-action 6.3.0 6.4.0
aquasecurity/trivy-action 0.32.0 0.33.1
anchore/scan-action 6.4.0 7.0.0
peter-evans/repository-dispatch 3.0.0 4.0.0

Updates actions/checkout from 4.2.2 to 5.0.0

Release notes

Sourced from actions/checkout's releases.

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v4...v4.3.0

Changelog

Sourced from actions/checkout's changelog.

Changelog

V5.0.0

V4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v4.1.5

v4.1.4

v4.1.3

... (truncated)

Commits

Updates actions/setup-go from 5 to 6

Release notes

Sourced from actions/setup-go's releases.

v6.0.0

What's Changed

Breaking Changes

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

New Contributors

Full Changelog: actions/setup-go@v5...v6.0.0

v5.5.0

What's Changed

Bug fixes:

Dependency updates:

New Contributors

Full Changelog: actions/setup-go@v5...v5.5.0

v5.4.0

What's Changed

Dependency updates :

... (truncated)

Commits

Updates actions/download-artifact from 4.1.3 to 5.0.0

Release notes

Sourced from actions/download-artifact's releases.

v5.0.0

What's Changed

v5.0.0

🚨 Breaking Change

This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.

What Changed

Previously, single artifact downloads behaved differently depending on how you specified the artifact:

  • By name: name: my-artifact → extracted to path/ (direct)
  • By ID: artifact-ids: 12345 → extracted to path/my-artifact/ (nested)

Now both methods are consistent:

  • By name: name: my-artifact → extracted to path/ (unchanged)
  • By ID: artifact-ids: 12345 → extracted to path/ (fixed - now direct)

Migration Guide

✅ No Action Needed If:
  • You download artifacts by name
  • You download multiple artifacts by ID
  • You already use merge-multiple: true as a workaround
⚠️ Action Required If:

You download single artifacts by ID and your workflows expect the nested directory structure.

Before v5 (nested structure):

- uses: actions/download-artifact@v4
  with:
    artifact-ids: 12345
    path: dist
# Files were in: dist/my-artifact/

Where my-artifact is the name of the artifact you previously uploaded

To maintain old behavior (if needed):

</tr></table>

... (truncated)

Commits
  • 634f93c Merge pull request #416 from actions/single-artifact-id-download-path
  • b19ff43 refactor: resolve download path correctly in artifact download tests (mainly ...
  • e262cbe bundle dist
  • bff23f9 update docs
  • fff8c14 fix download path logic when downloading a single artifact by id
  • 448e3f8 Merge pull request #407 from actions/nebuk89-patch-1
  • 47225c4 Update README.md
  • d3f86a1 Merge pull request #404 from actions/robherley/v4.3.0
  • fc02353 prep for v4.3.0 release
  • 7745437 Merge pull request #402 from actions/joshmgross/download-by-id-example
  • Additional commits viewable in compare view

Updates actions/cache from 4.2.3 to 4.3.0

Release notes

Sourced from actions/cache's releases.

v4.3.0

What's Changed

New Contributors

Full Changelog: actions/cache@v4...v4.3.0

v4.2.4

What's Changed

New Contributors

Full Changelog: actions/cache@v4...v4.2.4

Changelog

Sourced from actions/cache's changelog.

Releases

4.3.0

  • Bump @actions/cache to v4.1.0

4.2.4

  • Bump @actions/cache to v4.0.5

4.2.3

  • Bump @actions/cache to v4.0.3 (obfuscates SAS token in debug logs for cache entries)

4.2.2

  • Bump @actions/cache to v4.0.2

4.2.1

  • Bump @actions/cache to v4.0.1

4.2.0

TLDR; The cache backend service has been rewritten from the ground up for improved performance and reliability. actions/cache now integrates with the new cache service (v2) APIs.

The new service will gradually roll out as of February 1st, 2025. The legacy service will also be sunset on the same date. Changes in these release are fully backward compatible.

We are deprecating some versions of this action. We recommend upgrading to version v4 or v3 as soon as possible before February 1st, 2025. (Upgrade instructions below).

If you are using pinned SHAs, please use the SHAs of versions v4.2.0 or v3.4.0

If you do not upgrade, all workflow runs using any of the deprecated actions/cache will fail.

Upgrading to the recommended versions will not break your workflows.

4.1.2

  • Add GitHub Enterprise Cloud instances hostname filters to inform API endpoint choices - #1474
  • Security fix: Bump braces from 3.0.2 to 3.0.3 - #1475

4.1.1

  • Restore original behavior of cache-hit output - #1467

4.1.0

  • Ensure cache-hit output is set when a cache is missed - #1404
  • Deprecate save-always input - #1452

... (truncated)

Commits
  • 0057852 Merge pull request #1655 from actions/Link-/prepare-4.3.0
  • 4f5ea67 Update licensed cache
  • 9fcad95 Upgrade actions/cache to 4.1.0 and prepare 4.3.0 release
  • 638ed79 Merge pull request #1642 from actions/GhadimiR-patch-1
  • 3862dcc Add note on runner versions
  • 0400d5f Merge pull request #1636 from actions/Link-/release-4.2.4
  • 374a27f Prepare release 4.2.4
  • 358a730 Merge pull request #1634 from actions/Link-/optimise-deps
  • 2ee706e Fix with another approach
  • 94f7b5d Fix bundle exec
  • Additional commits viewable in compare view

Updates actions/setup-python from 5 to 6

Release notes

Sourced from actions/setup-python's releases.

v6.0.0

What's Changed

Breaking Changes

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Enhancements:

Bug fixes:

Dependency updates:

New Contributors

Full Changelog: actions/setup-python@v5...v6.0.0

v5.6.0

What's Changed

Full Changelog: actions/setup-python@v5...v5.6.0

v5.5.0

What's Changed

Enhancements:

Bug fixes:

... (truncated)

Commits
  • e797f83 Upgrade to node 24 (#1164)
  • 3d1e2d2 Revert "Enhance cache-dependency-path handling to support files outside the w...
  • 65b0712 Clarify pythonLocation behavior for PyPy and GraalPy in environment variables...
  • 5b668cf Bump actions/checkout from 4 to 5 (#1181)
  • f62a0e2 Change missing cache directory error to warning (#1182)
  • 9322b3c Upgrade setuptools to 78.1.1 to fix path traversal vulnerability in PackageIn...
  • fbeb884 Bump form-data to fix critical vulnerabilities #182 & #183 (#1163)
  • 03bb615 Bump idna from 2.9 to 3.7 in /tests/data (#843)
  • 36da51d Add version parsing from Pipfile (#1067)
  • 3c6f142 update documentation (#1156)
  • Additional commits viewable in compare view

Updates securego/gosec from 2.22.5 to 2.22.9

Release notes

Sourced from securego/gosec's releases.

v2.22.9

Changelog

  • 15d5c61e866bc2e2e8389376a31f1e5e09bde7d8 Update cosign to v2.6.0 and go in the CI to latest version
  • 7b8713e2c9114d7db686be71c260e4e9f7ffc2e9 fix(autofix): unnecessary conversion
  • 64ebfc010618034268272af465bb47dbbb49d64f feat(autofix): update gemini sdk and add anthropic claude
  • 506407e7dfe6979d514d362f0b2d2ea77f49f5c8 feat(G304): add os.Root remediation hint (Autofix) when Go >= 1.24
  • 3ead143f0a3b5ace623f1865ea0f560bf730cd32 chore(deps): update all dependencies
  • e81fba3c3afd54f0740d580297d9206d972d47b9 refactor(G304): remove unused trackJoin helper; no functional change
  • ab078db7b0e0de577588ae298d22d1b490bf136c style: gofmt rules/readfile.go
  • e6218c83ecf834512867fda709dbb096b9cc06aa test(g304): add samples for var perm and var flag with cleaned path\n\n- Ensure G304 does not fire when only non-path args (flag/perm) are variables\n- Both samples use filepath.Clean on the path arg\n- Rules suite remains green (42 passed)
  • 79f835d9c776f61d7d61505970829d8b3610b763 rules(G304): analyze only path arg; ignore flag/perm vars; track Clean and safe Join; fix nil-context panic\n\n- Limit G304 checks to first arg (path) for os.Open/OpenFile/ReadFile, avoiding false positives when flag/perm are variables\n- Track filepath.Clean so cleaned identifiers are treated as safe\n- Consider safe joins: filepath.Join(const|resolvedBase, Clean(var)|cleanedIdent)\n- Record Join(...) assigned to identifiers and allow if later cleaned\n- Fix panic by passing non-nil context in trackJoinAssignStmt\n- All rules tests: 42 passed
  • 40ac53017b81ea0e251e6d04eef0a3434773bf1c rules(G202): detect SQL concat in ValueSpec declarations; add test sample\n\n- Handle var query string = 'SELECT ...' + user style declarations\n- Reuse existing binary expr detection on ValueSpec.Values\n- Add postgres sample mirroring issue #1309 report\n- Rules tests: 42 passed
  • 4be6b11bbcb9a225e44194a8867ee4645a4eb618 chore(deps): update all dependencies
  • 5af1117217e476b56a63eaa9ea28eeeb91fbc5ff chore(deps): update all dependencies
  • 287b46c018ebe8ca18d45aa8fc0ebea927f1e27d chore(deps): update all dependencies
  • cee0aeae8a8b6c2d59571e500bc69010f2630db6 Update gosec version to v2.22.8 in the Github action

v2.22.8

Changelog

  • c9453023c4e81ebdb6dde29e22d9cd5e2285fb16 Add support for go version 1.25.0
  • ef7adab98ce3c9599c340cb6d6e988f666d9a866 Update go version in CI to 1.24.6 and 1.23.12
  • e201bb86c2a1ab06d6773b6185a5c16413267abf chore(deps): update all dependencies
  • ba592afef69e0e9f70adf25b95a15056cd61f015 chore(deps): update all dependencies
  • 2ef6017991fdf27d40052196a32571a0ba71dc9a Update github action to release v2.22.7

v2.22.7

Changelog

  • 32975f4bab0d7b683a88756aaf3fa5502188b476 Fix crash in hardcoded_nonce analyzer
  • 6ea6b35e61f367312f4ec362440c98891830286d Update go action to use release v2.22.6

v2.22.6

Changelog

  • bc3f2145b52adab91f2bee2686c9ad65e65005d6 Update go version to 1.24.5 and 1.23.11 in the CI
  • 925741b7eff92a31663cb1d4e84d809345029883 chore(deps): update module google.golang.org/api to v0.242.0
  • 59ae7e9e275d7dce03bb9c37432b7b3575dbe5fc chore(deps): update all dependencies
  • e7abd9e3482c9ba37761c7e39dad696d2fd7bedb chore(deps): update all dependencies
  • 35e7bc1a94c4df54c5f3f5debd3241b752c65a1a chore(deps): update all dependencies
  • 2d1ed95a0be84f9468a177e96285ab901051819c chore(deps): update all dependencies
  • 4a8cb4609fccc267e012189996cad9b08f2f2af8 Do not allow dashes in file names
  • bcc8afbe30446f2660a7b6b6909541e12fa28239 Update gosec to version 2.22.5 in Github action
Commits
  • 15d5c61 Update cosign to v2.6.0 and go in the CI to latest version
  • 7b8713e fix(autofix): unnecessary conversion
  • 64ebfc0 feat(autofix): update gemini sdk and add anthropic claude
  • 506407e feat(G304): add os.Root remediation hint (Autofix) when Go >= 1.24
  • 3ead143 chore(deps): update all dependencies
  • e81fba3 refactor(G304): remove unused trackJoin helper; no functional change
  • ab078db style: gofmt rules/readfile.go
  • e6218c8 test(g304): add samples for var perm and var flag with cleaned path\n\n- Ensu...
  • 79f835d rules(G304): analyze only path arg; ignore flag/perm vars; track Clean and sa...
  • 40ac530 rules(G202): detect SQL concat in ValueSpec declarations; add test sample\n\n...
  • Additional commits viewable in compare view

Updates actions/setup-node from 4 to 5

Release notes

Sourced from actions/setup-node's releases.

v5.0.0

What's Changed

Breaking Changes

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless. To disable this automatic caching, set package-manager-cache: false

steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

New Contributors

Full Changelog: actions/setup-node@v4...v5.0.0

v4.4.0

What's Changed

Bug fixes:

Enhancement:

Dependency update:

New Contributors

Full Changelog: actions/setup-node@v4...v4.4.0

... (truncated)

Commits

Updates checkmarx/kics-github-action from 2.1.13 to 2.1.14

Release notes

Sourced from checkmarx/kics-github-action's releases.

v2.1.14

What's Changed

Full Changelog: Checkmarx/kics-github-action@v2.1.13...v2.1.14

Commits

Updates docker/login-action from 3.4.0 to 3.6.0

Release notes

Sourced from docker/login-action's releases.

v3.6.0

Full Changelog: docker/login-action@v3.5.0...v3.6.0

v3.5.0

Full Changelog: docker/login-action@v3.4.0...v3.5.0

Commits
  • 5e57cd1 Merge pull request #890 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
  • 97e3143 chore: update generated content
  • 3a0796b build(deps): bump the aws-sdk-dependencies group with 2 updates
  • 5b7b28b Merge pull request #882 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
  • abc9fb3 chore: update generated content
  • d468688 build(deps): bump the aws-sdk-dependencies group with 2 updates

@dependabot
ci(deps): bump the all group across 1 directory with 14 updates
bf9b001 
Bumps the all group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `5.0.0` |
| [actions/setup-go](https://github.com/actions/setup-go) | `5` | `6` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.1.3` | `5.0.0` |
| [actions/cache](https://github.com/actions/cache) | `4.2.3` | `4.3.0` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5` | `6` |
| [securego/gosec](https://github.com/securego/gosec) | `2.22.5` | `2.22.9` |
| [actions/setup-node](https://github.com/actions/setup-node) | `4` | `5` |
| [checkmarx/kics-github-action](https://github.com/checkmarx/kics-github-action) | `2.1.13` | `2.1.14` |
| [docker/login-action](https://github.com/docker/login-action) | `3.4.0` | `3.6.0` |
| [docker/metadata-action](https://github.com/docker/metadata-action) | `5.7.0` | `5.8.0` |
| [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `6.3.0` | `6.4.0` |
| [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) | `0.32.0` | `0.33.1` |
| [anchore/scan-action](https://github.com/anchore/scan-action) | `6.4.0` | `7.0.0` |
| [peter-evans/repository-dispatch](https://github.com/peter-evans/repository-dispatch) | `3.0.0` | `4.0.0` |



Updates `actions/checkout` from 4.2.2 to 5.0.0
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11bd719...08c6903)

Updates `actions/setup-go` from 5 to 6
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@v5...v6)

Updates `actions/download-artifact` from 4.1.3 to 5.0.0
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v4.1.3...v5.0.0)

Updates `actions/cache` from 4.2.3 to 4.3.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@5a3ec84...0057852)

Updates `actions/setup-python` from 5 to 6
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v5...v6)

Updates `securego/gosec` from 2.22.5 to 2.22.9
- [Release notes](https://github.com/securego/gosec/releases)
- [Changelog](https://github.com/securego/gosec/blob/master/.goreleaser.yml)
- [Commits](securego/gosec@d2d3ae6...15d5c61)

Updates `actions/setup-node` from 4 to 5
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v5)

Updates `checkmarx/kics-github-action` from 2.1.13 to 2.1.14
- [Release notes](https://github.com/checkmarx/kics-github-action/releases)
- [Commits](Checkmarx/kics-github-action@7145454...c11ca46)

Updates `docker/login-action` from 3.4.0 to 3.6.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@74a5d14...5e57cd1)

Updates `docker/metadata-action` from 5.7.0 to 5.8.0
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@902fa8e...c1e5197)

Updates `goreleaser/goreleaser-action` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](goreleaser/goreleaser-action@9c156ee...e435ccd)

Updates `aquasecurity/trivy-action` from 0.32.0 to 0.33.1
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](aquasecurity/trivy-action@dc5a429...b6643a2)

Updates `anchore/scan-action` from 6.4.0 to 7.0.0
- [Release notes](https://github.com/anchore/scan-action/releases)
- [Changelog](https://github.com/anchore/scan-action/blob/main/RELEASE.md)
- [Commits](anchore/scan-action@16910ac...f660128)

Updates `peter-evans/repository-dispatch` from 3.0.0 to 4.0.0
- [Release notes](https://github.com/peter-evans/repository-dispatch/releases)
- [Commits](peter-evans/repository-dispatch@ff45666...5fc4efd)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all
- dependency-name: actions/setup-go
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all
- dependency-name: actions/download-artifact
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all
- dependency-name: actions/cache
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: actions/setup-python
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all
- dependency-name: securego/gosec
  dependency-version: 2.22.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: actions/setup-node
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all
- dependency-name: checkmarx/kics-github-action
  dependency-version: 2.1.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: docker/login-action
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: docker/metadata-action
  dependency-version: 5.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: goreleaser/goreleaser-action
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: aquasecurity/trivy-action
  dependency-version: 0.33.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: anchore/scan-action
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all
- dependency-name: peter-evans/repository-dispatch
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code labels Oct 1, 2025
@dependabot dependabot bot requested a review from a team as a code owner October 1, 2025 23:10
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code labels Oct 1, 2025
@github-actions github-actions bot added bug Something isn't working query New query feature docker Docker query arm Azure Resource Manager query aws PR related with AWS Cloud labels Oct 1, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
arm Azure Resource Manager query aws PR related with AWS Cloud bug Something isn't working dependencies Pull requests that update a dependency file docker Docker query github_actions Pull requests that update Github_actions code query New query feature
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants