chore(deps): bump the actions-deps group across 1 directory with 9 updates by dependabot[bot] · Pull Request #748 · OpenZeppelin/openzeppelin-relayer

dependabot · 2026-04-08T09:01:38Z

Bumps the actions-deps group with 9 updates in the / directory:

Package	From	To
step-security/harden-runner	`2.16.0`	`2.16.1`
taiki-e/install-action	`2.69.1`	`2.75.0`
github/codeql-action	`4.33.0`	`4.35.1`
codecov/codecov-action	`5.5.3`	`6.0.0`
anchore/scan-action	`7.3.2`	`7.4.0`
act10ns/slack	`2.1.0`	`2.2.0`
docker/login-action	`4.0.0`	`4.1.0`
iarekylew00t/verified-bot-commit	`2.1.8`	`2.2.2`
anchore/sbom-action	`0.23.1`	`0.24.0`

Updates step-security/harden-runner from 2.16.0 to 2.16.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.16.1

What's Changed

Enterprise tier: Added support for direct IP addresses in the allow list Community tier: Migrated Harden Runner telemetry to a new endpoint

Full Changelog: step-security/harden-runner@v2.16.0...v2.16.1

Commits

fe10465 v2.16.1 (#654)
See full diff in compare view

Updates taiki-e/install-action from 2.69.1 to 2.75.0

Release notes

Sourced from taiki-e/install-action's releases.

2.75.0

Support cosign. (#1677)

2.74.1

Update mise@latest to 2026.4.5.

Update tombi@latest to 0.9.15.

2.74.0

Support cargo-deb. (#1669)

Update just@latest to 1.49.0.

Update mise@latest to 2026.4.4.

2.73.0

Introduce dependency cooldown when installing with taiki-e/install-action@<tool_name>, tool: <tool_name>@latest, or tool: <tool_name>@<omitted_version> to mitigate the risk of supply chain attacks by default. (#1666)

This action without this cooldown already takes a few hours to a few days for new releases to be reflected (as with other common package managers that verify checksums or signatures), so this should not affect most users.

See the "Security" section in readme for more details.

Improve robustness for network failure.

Documentation improvements.

2.72.0

Support cargo-xwin. (#1659, thanks @daxpedda)

Support trailing comma in tool input option.

Update tombi@latest to 0.9.14.

2.71.3

Update wasm-tools@latest to 1.246.2.

Update mise@latest to 2026.4.3.

2.71.2

Implement workaround for windows-11-arm runner bug which sometimes causes installation failure. (#1657)

This addresses an issue that was attempted to be worked around in 2.71.0 but was insufficient.

Update mise@latest to 2026.4.1.

Update uv@latest to 0.11.3.

2.71.1

Fix a regression that caused an execution policy violation on self-hosted Windows runner due to use of non-default powershell shell, introduced in 2.71.0.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.75.0] - 2026-04-07

Support cosign. (#1677)

[2.74.1] - 2026-04-07

Update mise@latest to 2026.4.5.

Update tombi@latest to 0.9.15.

[2.74.0] - 2026-04-06

Support cargo-deb. (#1669)

Update just@latest to 1.49.0.

Update mise@latest to 2026.4.4.

[2.73.0] - 2026-04-05

Introduce dependency cooldown when installing with taiki-e/install-action@<tool_name>, tool: <tool_name>@latest, or tool: <tool_name>@<omitted_version> to mitigate the risk of supply chain attacks by default. (#1666)

This action without this cooldown already takes a few hours to a few days for new releases to be reflected (as with other common package managers that verify checksums or signatures), so this should not affect most users.

See the "Security" section in readme for more details.

Improve robustness for network failure.

Documentation improvements.

[2.72.0] - 2026-04-04

Support cargo-xwin. (#1659, thanks @daxpedda)

Support trailing comma in tool input option.

Update tombi@latest to 0.9.14.

... (truncated)

Commits

cf39a74 Release 2.75.0
0486bdd Support cosign
fbe29f7 ci: Enable dependabot grouped update for github-actions
2438243 Enable "Require actions to be pinned to a full-length commit SHA"
8504056 tools: Update tidy.sh
dcdbf46 ci: Update release workflow
8002e0e Release 2.74.1
025d8d1 Update mise@latest to 2026.4.5
e83b58f Update tombi@latest to 0.9.15
ebe7e09 Update shfmt manifest
Additional commits viewable in compare view

Updates github/codeql-action from 4.33.0 to 4.35.1

Release notes

Sourced from github/codeql-action's releases.

v4.35.1

Fix incorrect minimum required Git version for improved incremental analysis: it should have been 2.36.0, not 2.11.0. #3781

v4.35.0

Reduced the minimum Git version required for improved incremental analysis from 2.38.0 to 2.11.0. #3767

Update default CodeQL bundle version to 2.25.1. #3773

v4.34.1

Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #3762

v4.34.0

Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569

We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584

Update default CodeQL bundle version to 2.25.0. #3585

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795

The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789

Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794

4.35.1 - 27 Mar 2026

Fix incorrect minimum required Git version for improved incremental analysis: it should have been 2.36.0, not 2.11.0. #3781

4.35.0 - 27 Mar 2026

Reduced the minimum Git version required for improved incremental analysis from 2.38.0 to 2.11.0. #3767

Update default CodeQL bundle version to 2.25.1. #3773

4.34.1 - 20 Mar 2026

Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #3762

4.34.0 - 20 Mar 2026

Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569

We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584

Update default CodeQL bundle version to 2.25.0. #3585

4.33.0 - 16 Mar 2026

Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. #3562

To opt out of this change:

Repositories owned by an organization: Create a custom repository property with the name github-codeql-file-coverage-on-prs and the type "True/false", then set this property to true in the repository's settings. For more information, see Managing custom properties for repositories in your organization. Alternatively, if you are using an advanced setup workflow, you can set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

User-owned repositories using default setup: Switch to an advanced setup workflow and set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

User-owned repositories using advanced setup: Set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

Fixed a bug which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. #3557

The CodeQL Action now loads custom repository properties on GitHub Enterprise Server, enabling the customization of features such as github-codeql-disable-overlay that was previously only available on GitHub.com. #3559

Once private package registries can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. #3563

Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". #3564

A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. #3570

4.32.6 - 05 Mar 2026

Update default CodeQL bundle version to 2.24.3. #3548

4.32.5 - 02 Mar 2026

Repositories owned by an organization can now set up the github-codeql-disable-overlay custom repository property to disable improved incremental analysis for CodeQL. First, create a custom repository property with the name github-codeql-disable-overlay and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to true to disable improved incremental analysis. For more information, see Managing custom properties for repositories in your organization. This feature is not yet available on GitHub Enterprise Server. #3507

... (truncated)

Commits

c10b806 Merge pull request #3782 from github/update-v4.35.1-d6d1743b8
c5ffd06 Update changelog for v4.35.1
d6d1743 Merge pull request #3781 from github/henrymercer/update-git-minimum-version
65d2efa Add changelog note
2437b20 Update minimum git version for overlay to 2.36.0
ea5f719 Merge pull request #3775 from github/dependabot/npm_and_yarn/node-forge-1.4.0
45ceeea Merge pull request #3777 from github/mergeback/v4.35.0-to-main-b8bb9f28
24448c9 Rebuild
7c51060 Update changelog and version after v4.35.0
b8bb9f2 Merge pull request #3776 from github/update-v4.35.0-0078ad667
Additional commits viewable in compare view

Updates codecov/codecov-action from 5.5.3 to 6.0.0

Release notes

Sourced from codecov/codecov-action's releases.

v6.0.0

⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️

What's Changed

Revert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0"" by @thomasrockhu-codecov in codecov/codecov-action#1929

Th/6.0.0 by @thomasrockhu-codecov in codecov/codecov-action#1928

Full Changelog: codecov/codecov-action@v5.5.4...v6.0.0

v5.5.4

This is a mirror of v5.5.2. v6 will be released which requires node24

What's Changed

Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0" by @thomasrockhu-codecov in codecov/codecov-action#1926

chore(release): 5.5.4 by @thomasrockhu-codecov in codecov/codecov-action#1927

Full Changelog: codecov/codecov-action@v5.5.3...v5.5.4

Changelog

Sourced from codecov/codecov-action's changelog.

v5.5.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2

v5.5.1

What's Changed

fix: overwrite pr number on fork by @thomasrockhu-codecov in codecov/codecov-action#1871

build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @app/dependabot in codecov/codecov-action#1868

build(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by @app/dependabot in codecov/codecov-action#1867

fix: update to use local app/ dir by @thomasrockhu-codecov in codecov/codecov-action#1872

docs: fix typo in README by @datalater in codecov/codecov-action#1866

Document a codecov-cli version reference example by @webknjaz in codecov/codecov-action#1774

build(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by @app/dependabot in codecov/codecov-action#1861

build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @app/dependabot in codecov/codecov-action#1833

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1

v5.5.0

What's Changed

feat: upgrade wrapper to 0.2.4 by @jviall in codecov/codecov-action#1864

Pin actions/github-script by Git SHA by @martincostello in codecov/codecov-action#1859

fix: check reqs exist by @joseph-sentry in codecov/codecov-action#1835

fix: Typo in README by @spalmurray in codecov/codecov-action#1838

docs: Refine OIDC docs by @spalmurray in codecov/codecov-action#1837

build(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by @app/dependabot in codecov/codecov-action#1829

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0

v5.4.3

What's Changed

build(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by @app/dependabot in codecov/codecov-action#1822

fix: OIDC on forks by @joseph-sentry in codecov/codecov-action#1823

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3

v5.4.2

... (truncated)

Commits

57e3a13 Th/6.0.0 (#1928)
f67d33d Revert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0""...
75cd116 chore(release): 5.5.4 (#1927)
87d39f4 Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0" (#1926)
See full diff in compare view

Updates anchore/scan-action from 7.3.2 to 7.4.0

Release notes

Sourced from anchore/scan-action's releases.

v7.4.0

chore: update to node 24 (#629) [@kzantow]

fix(dev): move to esbuild (#601) [@willmurphyscode]

chore: update to ES modules + update @actions/* (#595) [@kzantow]

⬆️ Dependencies

chore(deps): update Grype to v0.110.0 (#618) [@anchore-actions-token-generator[bot]]

chore(deps-dev): bump tar 7.5.11 (#620) [@dependabot[bot]]

chore(deps): bump undici 6.24.1 (#622) [@dependabot[bot]]

chore: bump fast-xml-parser 5.5.7 (#626) [@dependabot[bot]]

Commits

e116508 chore: bump fast-xml-parser from 5.5.6 to 5.5.7 + setup-node (#631)
382a23a chore(deps): update Grype to v0.110.0 (#618)
2898213 chore: update to node 24 (#629)
4e1eb5b chore: update to modules and bump all deps (required for new @actions librari...
8ed60d1 chore(deps): bump actions/setup-node from 6.2.0 to 6.3.0 (#617)
5a271d2 chore(deps-dev): bump lint-staged from 16.3.1 to 16.3.2 (#619)
6d37af2 chore(deps-dev): bump jest from 30.2.0 to 30.3.0 (#625)
50a8160 chore(deps-dev): bump tar from 7.5.10 to 7.5.11 (#620)
daeb723 chore(deps): bump undici from 6.23.0 to 6.24.1 (#622)
6471a7e chore(deps): bump fast-xml-parser from 5.3.6 to 5.5.6 (#626)
Additional commits viewable in compare view

Updates act10ns/slack from 2.1.0 to 2.2.0

Release notes

Sourced from act10ns/slack's releases.

v2.2.0

What's New

Features

Multiple channels — channel input now accepts multiple channels separated by spaces or commas

Blocks-only mode — new blocks_only config option to send only blocks without the legacy attachment

Workflow-level status — documented pattern for reporting multi-job workflow status

Template variables reference — full table of all supported Handlebars template variables in README

Bug Fixes

Filter unnamed steps — steps without an explicit id (auto-generated hex hashes) are now filtered out (#131)

Retry on failure — webhook send retries up to 3 times with linear backoff on transient errors (#196)

Sanitize template data — user-controlled data (commit messages, PR titles) containing Handlebars syntax no longer causes runtime errors (#259)

Warn on missing config — emits a warning when a custom config file path is specified but not found (#267)

Stale dist — jobInputs and all recent features now included in bundled dist (#278)

Infrastructure

Node.js 24 runtime (previously Node.js 20) (#284)

Auto-rebuild dist — CI workflow automatically rebuilds dist/ on merge to master

Security dependency updates — cross-spawn, minimatch, flatted, picomatch, handlebars, axios, js-yaml

Documentation

Added CLAUDE.md for contributor guidance

Updated README with corrected examples, current GitHub docs URLs, and copyright year

Commits

d96404e Rebuild dist [skip ci]
e108fcc Merge pull request #301 from act10ns/dependabot/npm_and_yarn/multi-75e6bc5210
ffe143e Bump js-yaml
9b6eafd Rebuild dist [skip ci]
27d94b3 Merge pull request #286 from act10ns/dependabot/npm_and_yarn/axios-1.14.0
cc49177 Merge pull request #285 from act10ns/dependabot/npm_and_yarn/handlebars-4.7.9
689dfe0 Rebuild dist [skip ci]
6972e9c Merge pull request #289 from act10ns/dependabot/npm_and_yarn/picomatch-2.3.2
9e39a0b Merge pull request #288 from act10ns/dependabot/npm_and_yarn/flatted-3.4.2
c73e9b2 Merge pull request #287 from act10ns/dependabot/npm_and_yarn/minimatch-3.1.5
Additional commits viewable in compare view

Updates docker/login-action from 4.0.0 to 4.1.0

Release notes

Sourced from docker/login-action's releases.

v4.1.0

Fix scoped Docker Hub cleanup path when registry is omitted by @crazy-max in docker/login-action#945

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1020.0 in docker/login-action#930

Bump @docker/actions-toolkit from 0.77.0 to 0.86.0 in docker/login-action#932 docker/login-action#936

Bump brace-expansion from 1.1.12 to 1.1.13 in docker/login-action#952

Bump fast-xml-parser from 5.3.4 to 5.3.6 in docker/login-action#942

Bump flatted from 3.3.3 to 3.4.2 in docker/login-action#944

Bump glob from 10.3.12 to 10.5.0 in docker/login-action#940

Bump handlebars from 4.7.8 to 4.7.9 in docker/login-action#949

Bump http-proxy-agent and https-proxy-agent to 8.0.0 in docker/login-action#937

Bump lodash from 4.17.23 to 4.18.1 in docker/login-action#958

Bump minimatch from 3.1.2 to 3.1.5 in docker/login-action#941

Bump picomatch from 4.0.3 to 4.0.4 in docker/login-action#948

Bump undici from 6.23.0 to 6.24.1 in docker/login-action#938

Full Changelog: docker/login-action@v4.0.0...v4.1.0

Commits

4907a6d Merge pull request #930 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
1e233e6 chore: update generated content
6c24ead build(deps): bump the aws-sdk-dependencies group with 2 updates
ee034d7 Merge pull request #958 from docker/dependabot/npm_and_yarn/lodash-4.18.1
1527209 Merge pull request #937 from docker/dependabot/npm_and_yarn/proxy-agent-depen...
d39362a build(deps): bump lodash from 4.17.23 to 4.18.1
a6f092b chore: update generated content
60953f0 build(deps): bump the proxy-agent-dependencies group with 2 updates
62c6885 Merge pull request #936 from docker/dependabot/npm_and_yarn/docker/actions-to...
102c0e6 chore: update generated content
Additional commits viewable in compare view

Updates iarekylew00t/verified-bot-commit from 2.1.8 to 2.2.2

Release notes

Sourced from iarekylew00t/verified-bot-commit's releases.

v2.2.2

What's Changed

🏗️ Dependencies

build(deps-dev): Bump the npm-development group with 2 updates by @dependabot[bot] in IAreKyleW00t/verified-bot-commit#321

build(deps): Bump github/codeql-action from 4.34.1 to 4.35.1 in the actions group by @dependabot[bot] in IAreKyleW00t/verified-bot-commit#320

build(deps): Bump minimatch from 10.2.4 to 10.2.5 in the npm-production group across 1 directory by @dependabot[bot] in IAreKyleW00t/verified-bot-commit#323

build(deps-dev): Bump ts-jest from 29.4.6 to 29.4.9 in the npm-development group by @dependabot[bot] in IAreKyleW00t/verified-bot-commit#324

Full Changelog: IAreKyleW00t/verified-bot-commit@v2.2.1...v2.2.2

v2.2.1

What's Changed

🏗️ Dependencies

build(deps-dev): Bump the npm-development group with 3 updates by @dependabot[bot] in IAreKyleW00t/verified-bot-commit#313

build(deps): Bump github/codeql-action from 4.33.0 to 4.34.1 in the actions group by @dependabot[bot] in IAreKyleW00t/verified-bot-commit#312

build(deps-dev): Bump eslint-plugin-jest from 29.15.0 to 29.15.1 in the npm-development group by @dependabot[bot] in IAreKyleW00t/verified-bot-commit#316

build(deps-dev): Bump picomatch from 2.3.1 to 2.3.2 by @dependabot[bot] in IAreKyleW00t/verified-bot-commit#317

build(deps-dev): Bump handlebars from 4.7.8 to 4.7.9 by @dependabot[bot] in IAreKyleW00t/verified-bot-commit#318

build(deps-dev): Bump brace-expansion from 1.1.12 to 1.1.13 by @dependabot[bot] in IAreKyleW00t/verified-bot-commit#319

Full Changelog: IAreKyleW00t/verified-bot-commit@v2.2.0...v2.2.1

v2.2.0

What's Changed

✨ Other Changes

feat: Adding support for empty commits by @IAreKyleW00t in IAreKyleW00t/verified-bot-commit#310

🏗️ Dependencies

build(deps): Bump actions/create-github-app-token from 2.2.1 to 3.0.0 by @dependabot[bot] in IAreKyleW00t/verified-bot-commit#307

build(deps): Bump the actions group with 2 updates by @dependabot[bot] in IAreKyleW00t/verified-bot-commit#306

build(deps-dev): Bump the npm-development group with 2 updates by @dependabot[bot] in IAreKyleW00t/verified-bot-commit#308

build(deps-dev): Bump flatted from 3.3.4 to 3.4.2 by @dependabot[bot] in IAreKyleW00t/verified-bot-commit#311

Full Changelog: IAreKyleW00t/verified-bot-commit@v2.1.8...v2.2.0

Commits

4aeee09 chore: Bumping version to v2.2.2
32c6d8f build(deps-dev): Bump ts-jest from 29.4.6 to 29.4.9 in the npm-development gr...
33fec29 build(deps): Bump minimatch from 10.2.4 to 10.2.5 in the npm-production group...
0f5e526 build(deps): Bump github/codeql-action from 4.34.1 to 4.35.1 in the actions g...
87cc679 build(deps-dev): Bump the npm-development group with 2 updates (#321)
bbc32e6 chore: Using github-bot for releases
70e8fca chore: Locking down version tags and releases
934fa64 chore: Bumping version to v2.2.1
11d8d47 build(deps-dev): Bump brace-expansion from 1.1.12 to 1.1.13 (#319)
4292cc8 build(deps-dev): Bump handlebars from 4.7.8 to 4.7.9 (#318)
Additional commits viewable in compare view

Updates anchore/sbom-action from 0.23.1 to 0.24.0

Release notes

Sourced from anchore/sbom-action's releases.

v0.24.0

chore: update to node 24 + deps (#614) [@kzantow]

chore: update to ES modules (#595) [@kzantow]

⬆️ Dependencies

chore(deps): update Syft to v1.42.3 (#615) [@anchore-actions-token-generator[bot]]

Commits

e22c389 chore(deps): update Syft to v1.42.3 (#615)
36a5fde chore: update to node 24 + deps (#614)
a0a6512 chore(deps): bump actions/setup-node from 6.2.0 to 6.3.0 (#608)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…dates Bumps the actions-deps group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.16.0` | `2.16.1` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.69.1` | `2.75.0` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.33.0` | `4.35.1` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.5.3` | `6.0.0` | | [anchore/scan-action](https://github.com/anchore/scan-action) | `7.3.2` | `7.4.0` | | [act10ns/slack](https://github.com/act10ns/slack) | `2.1.0` | `2.2.0` | | [docker/login-action](https://github.com/docker/login-action) | `4.0.0` | `4.1.0` | | [iarekylew00t/verified-bot-commit](https://github.com/iarekylew00t/verified-bot-commit) | `2.1.8` | `2.2.2` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.23.1` | `0.24.0` | Updates `step-security/harden-runner` from 2.16.0 to 2.16.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@fa2e9d6...fe10465) Updates `taiki-e/install-action` from 2.69.1 to 2.75.0 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@e24b8b7...cf39a74) Updates `github/codeql-action` from 4.33.0 to 4.35.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b1bff81...c10b806) Updates `codecov/codecov-action` from 5.5.3 to 6.0.0 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@1af5884...57e3a13) Updates `anchore/scan-action` from 7.3.2 to 7.4.0 - [Release notes](https://github.com/anchore/scan-action/releases) - [Changelog](https://github.com/anchore/scan-action/blob/main/RELEASE.md) - [Commits](anchore/scan-action@7037fa0...e116508) Updates `act10ns/slack` from 2.1.0 to 2.2.0 - [Release notes](https://github.com/act10ns/slack/releases) - [Changelog](https://github.com/act10ns/slack/blob/master/RELEASE.md) - [Commits](act10ns/slack@4454124...d96404e) Updates `docker/login-action` from 4.0.0 to 4.1.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@b45d80f...4907a6d) Updates `iarekylew00t/verified-bot-commit` from 2.1.8 to 2.2.2 - [Release notes](https://github.com/iarekylew00t/verified-bot-commit/releases) - [Commits](IAreKyleW00t/verified-bot-commit@b12a125...4aeee09) Updates `anchore/sbom-action` from 0.23.1 to 0.24.0 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](anchore/sbom-action@57aae52...e22c389) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.16.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: taiki-e/install-action dependency-version: 2.75.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: codecov/codecov-action dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-deps - dependency-name: anchore/scan-action dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: act10ns/slack dependency-version: 2.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: docker/login-action dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: iarekylew00t/verified-bot-commit dependency-version: 2.2.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: anchore/sbom-action dependency-version: 0.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Apr 8, 2026

dependabot Bot requested a review from a team as a code owner April 8, 2026 09:01

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Apr 8, 2026

github-actions Bot added the cla: signed label Apr 8, 2026

tirumerla approved these changes Apr 8, 2026

View reviewed changes

tirumerla merged commit e179128 into main Apr 8, 2026
18 checks passed

tirumerla deleted the dependabot/github_actions/actions-deps-6a3b8b72d4 branch April 8, 2026 09:52

github-actions Bot locked and limited conversation to collaborators Apr 8, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the actions-deps group across 1 directory with 9 updates#748

chore(deps): bump the actions-deps group across 1 directory with 9 updates#748
tirumerla merged 1 commit into
mainfrom
dependabot/github_actions/actions-deps-6a3b8b72d4

dependabot Bot commented on behalf of github Apr 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Apr 8, 2026

v2.16.1

What's Changed

2.75.0

2.74.1

2.74.0

2.73.0

2.72.0

2.71.3

2.71.2

2.71.1

Changelog

[Unreleased]

[2.75.0] - 2026-04-07

[2.74.1] - 2026-04-07

[2.74.0] - 2026-04-06

[2.73.0] - 2026-04-05

[2.72.0] - 2026-04-04

v4.35.1

v4.35.0

v4.34.1

v4.34.0

CodeQL Action Changelog

[UNRELEASED]

4.35.1 - 27 Mar 2026

4.35.0 - 27 Mar 2026

4.34.1 - 20 Mar 2026

4.34.0 - 20 Mar 2026

4.33.0 - 16 Mar 2026

4.32.6 - 05 Mar 2026

4.32.5 - 02 Mar 2026

v6.0.0

⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️

What's Changed

v5.5.4

What's Changed

v5.5.2

What's Changed

v5.5.1

What's Changed

v5.5.0

What's Changed

v5.4.3

What's Changed

v5.4.2

v7.4.0

⬆️ Dependencies

v2.2.0

What's New

Features

Bug Fixes

Infrastructure

Documentation

v4.1.0

v2.2.2

What's Changed

🏗️ Dependencies

v2.2.1

What's Changed

🏗️ Dependencies

v2.2.0

What's Changed

✨ Other Changes

🏗️ Dependencies

v0.24.0

⬆️ Dependencies

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant