Skip to content

Bump the actions group with 7 updates#3239

Merged
SharpRake merged 1 commit into
mainfrom
dependabot/github_actions/actions-6e6c551681
Apr 15, 2026
Merged

Bump the actions group with 7 updates#3239
SharpRake merged 1 commit into
mainfrom
dependabot/github_actions/actions-6e6c551681

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 13, 2026

Bumps the actions group with 7 updates:

Package From To
step-security/harden-runner 2.16.0 2.17.0
step-security/action-actionlint 1.69.1 1.72.0
chainguard-dev/actions 1.6.13 1.6.14
peter-evans/create-pull-request 8.1.0 8.1.1
actions/cache 5.0.4 5.0.5
actions/upload-artifact 7.0.0 7.0.1
zizmorcore/zizmor-action 0.5.2 0.5.3

Updates step-security/harden-runner from 2.16.0 to 2.17.0

Release notes

Sourced from step-security/harden-runner's releases.

v2.17.0

What's Changed

Policy Store Support

Added use-policy-store and api-key inputs to fetch security policies directly from the StepSecurity Policy Store. Policies can be defined and attached at the workflow, repo, org, or cluster (ARC) level, with the most granular policy taking precedence. This is the preferred method over the existing policy input which requires id-token: write permission. If no policy is found in the store, the action defaults to audit mode.

Full Changelog: step-security/harden-runner@v2.16.1...v2.17.0

v2.16.1

What's Changed

Enterprise tier: Added support for direct IP addresses in the allow list Community tier: Migrated Harden Runner telemetry to a new endpoint

Full Changelog: step-security/harden-runner@v2.16.0...v2.16.1

Commits

Updates step-security/action-actionlint from 1.69.1 to 1.72.0

Release notes

Sourced from step-security/action-actionlint's releases.

v1.72.0

What's Changed

Full Changelog: step-security/action-actionlint@v1...v1.72.0

Commits
  • c3aa382 Merge pull request #48 from step-security/Raj-StepSecurity-patch-5
  • 188cd00 feat: Update action.yml
  • ad8da1c Merge pull request #47 from step-security/feat/update-subscription-check
  • 5854b1c updated subscription check
  • 768d7ac feat: added banner and update subscription check to make maintained actions f...
  • d900753 Merge pull request #46 from step-security/auto-cherry-pick
  • 2b0ed1a chore: Cherry-picked changes from upstream
  • 6d6d45b Merge pull request #45 from step-security/amanstep-patch-5
  • 9b465ba feat: updated the docker image
  • 6d6fa1d Merge pull request #44 from step-security/fix/vulnerability4
  • Additional commits viewable in compare view

Updates chainguard-dev/actions from 1.6.13 to 1.6.14

Release notes

Sourced from chainguard-dev/actions's releases.

v1.6.14

What's Changed

Full Changelog: chainguard-dev/actions@v1.6.13...v1.6.14

Commits
  • de68b87 build(deps): bump step-security/harden-runner from 2.16.1 to 2.17.0 (#845)
  • af96613 build(deps): bump actions/github-script in /githubapp-token (#846)
  • 35ef116 chore(workflows): add github action linters [SECINT-75] (#844)
  • a0a960b build(deps): bump chainguard-dev/actions in /goimports (#840)
  • 06b7943 build(deps): bump chainguard-dev/actions in /inky-build-pkg (#841)
  • 14e76b5 build(deps): bump chainguard-dev/actions in /melange-build (#842)
  • 23d501f build(deps): bump chainguard-dev/actions in /wolfi-build-pkg (#843)
  • acb3c1e build(deps): bump chainguard-dev/actions from 1.6.11 to 1.6.13 in /gofmt (#839)
  • e7fcfbe build(deps): bump chainguard-dev/actions from 1.6.11 to 1.6.13 (#838)
  • See full diff in compare view

Updates peter-evans/create-pull-request from 8.1.0 to 8.1.1

Release notes

Sourced from peter-evans/create-pull-request's releases.

Create Pull Request v8.1.1

What's Changed

Full Changelog: peter-evans/create-pull-request@v8.1.0...v8.1.1

Commits
  • 5f6978f fix: retry post-creation API calls on 422 eventual consistency errors (#4356)
  • d32e88d build(deps-dev): bump the npm group with 3 updates (#4349)
  • 8170bcc build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 (#4344)
  • 0041819 build(deps): bump picomatch (#4339)
  • b993918 build(deps-dev): bump flatted from 3.3.1 to 3.4.2 (#4334)
  • 36d7c84 build(deps-dev): bump undici from 6.23.0 to 6.24.0 (#4328)
  • a45d1fb build(deps): bump @​tootallnate/once and jest-environment-jsdom (#4323)
  • 3499eb6 build(deps): bump the github-actions group with 2 updates (#4316)
  • 3f3b473 build(deps): bump minimatch (#4311)
  • 6699836 build(deps-dev): bump the npm group with 2 updates (#4305)
  • See full diff in compare view

Updates actions/cache from 5.0.4 to 5.0.5

Release notes

Sourced from actions/cache's releases.

v5.0.5

What's Changed

Full Changelog: actions/cache@v5...v5.0.5

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

  • Bump @actions/cache to v5.0.3 #1692

5.0.1

  • Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

Updates actions/upload-artifact from 7.0.0 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Full Changelog: actions/upload-artifact@v7...v7.0.1

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • See full diff in compare view

Updates zizmorcore/zizmor-action from 0.5.2 to 0.5.3

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.5.3

  • 1.24.0 and 1.24.1 are now available via the action
  • 1.24.1 is now the default version of zizmor used by the action
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the actions group with 7 updates
e94e5a3 
Bumps the actions group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.16.0` | `2.17.0` |
| [step-security/action-actionlint](https://github.com/step-security/action-actionlint) | `1.69.1` | `1.72.0` |
| [chainguard-dev/actions](https://github.com/chainguard-dev/actions) | `1.6.13` | `1.6.14` |
| [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `8.1.0` | `8.1.1` |
| [actions/cache](https://github.com/actions/cache) | `5.0.4` | `5.0.5` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.2` | `0.5.3` |


Updates `step-security/harden-runner` from 2.16.0 to 2.17.0
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@v2.16.0...f808768)

Updates `step-security/action-actionlint` from 1.69.1 to 1.72.0
- [Release notes](https://github.com/step-security/action-actionlint/releases)
- [Commits](step-security/action-actionlint@d364e70...c3aa382)

Updates `chainguard-dev/actions` from 1.6.13 to 1.6.14
- [Release notes](https://github.com/chainguard-dev/actions/releases)
- [Commits](chainguard-dev/actions@f45211d...de68b87)

Updates `peter-evans/create-pull-request` from 8.1.0 to 8.1.1
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](peter-evans/create-pull-request@c0f553f...5f6978f)

Updates `actions/cache` from 5.0.4 to 5.0.5
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@6682284...27d5ce7)

Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@bbbca2d...043fb46)

Updates `zizmorcore/zizmor-action` from 0.5.2 to 0.5.3
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@71321a2...b1d7e1f)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: step-security/action-actionlint
  dependency-version: 1.72.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: chainguard-dev/actions
  dependency-version: 1.6.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: peter-evans/create-pull-request
  dependency-version: 8.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/cache
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github-actions security labels Apr 13, 2026
@dependabot dependabot Bot requested a review from a team as a code owner April 13, 2026 23:03
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github-actions security labels Apr 13, 2026
@netlify
Copy link
Copy Markdown

netlify Bot commented Apr 13, 2026 •
edited
Loading

✅ Deploy Preview for ornate-narwhal-088216 ready!

Name Link
🔨 Latest commit e94e5a3
🔍 Latest deploy log https://app.netlify.com/projects/ornate-narwhal-088216/deploys/69dd76433e16640008ad5d93
😎 Deploy Preview https://deploy-preview-3239--ornate-narwhal-088216.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@SharpRake SharpRake merged commit 1e398ee into main Apr 15, 2026
13 checks passed
@SharpRake SharpRake deleted the dependabot/github_actions/actions-6e6c551681 branch April 15, 2026 19:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@SharpRake SharpRake SharpRake approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github-actions security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@SharpRake