Skip to content

deps: Bump the actions group with 5 updates#74

Merged
halostatue merged 1 commit into
mainfrom
dependabot/github_actions/actions-c833dd6052
May 1, 2026
Merged

deps: Bump the actions group with 5 updates#74
halostatue merged 1 commit into
mainfrom
dependabot/github_actions/actions-c833dd6052

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 5 updates:

Package From To
step-security/harden-runner 2.14.0 2.19.0
erlef/setup-beam 1.20.4 1.24.0
actions/cache 5.0.4 5.0.5
reviewdog/action-actionlint 1.71.0 1.72.0
zizmorcore/zizmor-action 0.5.2 0.5.3

Updates step-security/harden-runner from 2.14.0 to 2.19.0

Release notes

Sourced from step-security/harden-runner's releases.

v2.19.0

What's Changed

New Runner Support

Harden-Runner now supports Depot, Blacksmith, Namespace, and WarpBuild runners with the same egress monitoring, runtime monitoring, and policy enforcement available on GitHub-hosted runners.

Automated Incident Response for Supply Chain Attacks

  • Global block list: Outbound connections to known malicious domains and IPs are now blocked even in audit mode.
  • System-defined detection rules: Harden-Runner will trigger lockdown mode when a high risk event is detected during an active supply chain attack (for example, a process reading the memory of the runner worker process, a common technique for stealing GitHub Actions secrets).

Bug Fixes

Windows and macOS: stability and reliability fixes

Full Changelog: step-security/harden-runner@v2.18.0...v2.19.0

v2.18.0

What's Changed

Global Block List: During supply chain incidents like the recent axios and trivy compromises, StepSecurity will add known malicious domains and IP addresses (IOCs) to a global block list. These will be automatically blocked, even in audit mode, providing immediate protection without requiring any workflow changes.

Deploy on Self-Hosted VM: Added deploy-on-self-hosted-vm input that allows the Harden Runner agent to be installed directly on ephemeral self-hosted Linux runner VMs at workflow runtime. This is intended as an alternative when baking the agent into the VM image is not possible.

Full Changelog: step-security/harden-runner@v2.17.0...v2.18.0

v2.17.0

What's Changed

Policy Store Support

Added use-policy-store and api-key inputs to fetch security policies directly from the StepSecurity Policy Store. Policies can be defined and attached at the workflow, repo, org, or cluster (ARC) level, with the most granular policy taking precedence. This is the preferred method over the existing policy input which requires id-token: write permission. If no policy is found in the store, the action defaults to audit mode.

Full Changelog: step-security/harden-runner@v2.16.1...v2.17.0

v2.16.1

What's Changed

Enterprise tier: Added support for direct IP addresses in the allow list Community tier: Migrated Harden Runner telemetry to a new endpoint

Full Changelog: step-security/harden-runner@v2.16.0...v2.16.1

v2.16.0

What's Changed

  • Updated action.yml to use node24
  • Security fix: Fixed a medium severity vulnerability where the egress block policy could be bypassed via DNS over HTTPS (DoH) by proxying DNS queries through a permitted resolver, allowing data exfiltration even with a restrictive allowed-endpoints list. This issue only affects the Community Tier; the Enterprise Tier is not affected. See GHSA-46g3-37rh-v698 for details.
  • Security fix: Fixed a medium severity vulnerability where the egress block policy could be bypassed via DNS queries over TCP to external resolvers, allowing outbound network communication that evades configured network restrictions. This issue only affects the Community Tier; the Enterprise Tier is not affected. See GHSA-g699-3x6g-wm3g for details.

Full Changelog: step-security/harden-runner@v2.15.1...v2.16.0

v2.15.1

What's Changed

... (truncated)

Commits

Updates erlef/setup-beam from 1.20.4 to 1.24.0

Release notes

Sourced from erlef/setup-beam's releases.

v1.24.0

⚠️ Potentially breaking changes

Since GitHub is phasing out Node 20 runners, the erlef/setup-beam action has updated its requirements ([see PR #426](erlef/setup-beam#426)). Please ensure your workflow files are updated to align with the latest GitHub Actions standards to avoid execution failures.

What's Changed

New Contributors

Full Changelog: erlef/setup-beam@v1...v1.24.0

v1.23.0

What's Changed

Features

Fixes

Documentation

Version updates

New Contributors

... (truncated)

Commits
  • fc68ffb Automation: update setup-beam version output to 190c3a5
  • 190c3a5 Fix error that occurs when parsing TOML files that use dotted keys (#444)
  • 92dab89 Automation: update setup-beam version output to 5dfda65
  • 5dfda65 fix: address Prototype Pollution via parse() in NodeJS flatted (#445)
  • ef385d6 Automation: update setup-beam version output to bf3c3af
  • bf3c3af Bump picomatch from 4.0.3 to 4.0.4 in the npm_and_yarn group across 1 directo...
  • e7645e4 Automation: update setup-beam version output to a36098e
  • a36098e Bump csv-parse from 6.1.0 to 6.2.1 (#440)
  • 87781dc Automation: update setup-beam version output to d5f3979
  • d5f3979 Support Node 24 runtime (#426)
  • Additional commits viewable in compare view

Updates actions/cache from 5.0.4 to 5.0.5

Release notes

Sourced from actions/cache's releases.

v5.0.5

What's Changed

Full Changelog: actions/cache@v5...v5.0.5

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

  • Bump @actions/cache to v5.0.3 #1692

5.0.1

  • Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

Updates reviewdog/action-actionlint from 1.71.0 to 1.72.0

Release notes

Sourced from reviewdog/action-actionlint's releases.

Release v1.72.0

v1.72.0: PR #196 - chore(deps): update actionlint to 1.7.12

Commits
  • 6fb7acc bump v1.72.0
  • b2a904a Merge branch 'main' into releases/v1
  • 5eaffa1 Merge pull request #196 from reviewdog/depup/actionlint
  • 39a6754 chore(deps): update actionlint to 1.7.12
  • d39025c Merge pull request #195 from reviewdog/renovate/docker-setup-buildx-action-4.x
  • 2e8272d Merge pull request #194 from reviewdog/renovate/docker-setup-qemu-action-4.x
  • 128d9b7 Merge pull request #190 from reviewdog/renovate/shogo82148-actions-create-rel...
  • 1674e4f chore(deps): update docker/setup-buildx-action action to v4
  • 8fdb9d2 Merge pull request #189 from reviewdog/renovate/docker-setup-buildx-action-3.x
  • a518ce8 Merge pull request #188 from reviewdog/renovate/peter-evans-create-pull-reque...
  • Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.5.2 to 0.5.3

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.5.3

What's Changed

  • 1.24.0 and 1.24.1 are now available via the action
  • 1.24.1 is now the default version of zizmor used by the action

Full Changelog: zizmorcore/zizmor-action@v0.5.2...v0.5.3

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: Bump the actions group with 5 updates
4225d2a 
Bumps the actions group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.14.0` | `2.19.0` |
| [erlef/setup-beam](https://github.com/erlef/setup-beam) | `1.20.4` | `1.24.0` |
| [actions/cache](https://github.com/actions/cache) | `5.0.4` | `5.0.5` |
| [reviewdog/action-actionlint](https://github.com/reviewdog/action-actionlint) | `1.71.0` | `1.72.0` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.2` | `0.5.3` |


Updates `step-security/harden-runner` from 2.14.0 to 2.19.0
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@20cf305...8d3c67d)

Updates `erlef/setup-beam` from 1.20.4 to 1.24.0
- [Release notes](https://github.com/erlef/setup-beam/releases)
- [Commits](erlef/setup-beam@e6d7c94...fc68ffb)

Updates `actions/cache` from 5.0.4 to 5.0.5
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@6682284...27d5ce7)

Updates `reviewdog/action-actionlint` from 1.71.0 to 1.72.0
- [Release notes](https://github.com/reviewdog/action-actionlint/releases)
- [Commits](reviewdog/action-actionlint@0d952c5...6fb7acc)

Updates `zizmorcore/zizmor-action` from 0.5.2 to 0.5.3
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@71321a2...b1d7e1f)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: erlef/setup-beam
  dependency-version: 1.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/cache
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: reviewdog/action-actionlint
  dependency-version: 1.72.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 1, 2026
@halostatue
halostatue merged commit 0f4472f into main May 1, 2026
14 checks passed
@halostatue
halostatue deleted the dependabot/github_actions/actions-c833dd6052 branch May 1, 2026 13:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@halostatue