Skip to content

build(deps): bump the actions group with 4 updates#126

Merged
cpanato merged 1 commit into
mainfrom
dependabot/github_actions/actions-bcfbba1f85
Apr 13, 2026
Merged

build(deps): bump the actions group with 4 updates#126
cpanato merged 1 commit into
mainfrom
dependabot/github_actions/actions-bcfbba1f85

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 13, 2026

Bumps the actions group with 4 updates: step-security/harden-runner, step-security/action-actionlint, chainguard-dev/actions and peter-evans/create-pull-request.

Updates step-security/harden-runner from 2.16.0 to 2.17.0

Release notes

Sourced from step-security/harden-runner's releases.

v2.17.0

What's Changed

Policy Store Support

Added use-policy-store and api-key inputs to fetch security policies directly from the StepSecurity Policy Store. Policies can be defined and attached at the workflow, repo, org, or cluster (ARC) level, with the most granular policy taking precedence. This is the preferred method over the existing policy input which requires id-token: write permission. If no policy is found in the store, the action defaults to audit mode.

Full Changelog: step-security/harden-runner@v2.16.1...v2.17.0

v2.16.1

What's Changed

Enterprise tier: Added support for direct IP addresses in the allow list Community tier: Migrated Harden Runner telemetry to a new endpoint

Full Changelog: step-security/harden-runner@v2.16.0...v2.16.1

Commits

Updates step-security/action-actionlint from 1.69.1 to 1.72.0

Release notes

Sourced from step-security/action-actionlint's releases.

v1.72.0

What's Changed

Full Changelog: step-security/action-actionlint@v1...v1.72.0

Commits
  • c3aa382 Merge pull request #48 from step-security/Raj-StepSecurity-patch-5
  • 188cd00 feat: Update action.yml
  • ad8da1c Merge pull request #47 from step-security/feat/update-subscription-check
  • 5854b1c updated subscription check
  • 768d7ac feat: added banner and update subscription check to make maintained actions f...
  • d900753 Merge pull request #46 from step-security/auto-cherry-pick
  • 2b0ed1a chore: Cherry-picked changes from upstream
  • 6d6d45b Merge pull request #45 from step-security/amanstep-patch-5
  • 9b465ba feat: updated the docker image
  • 6d6fa1d Merge pull request #44 from step-security/fix/vulnerability4
  • Additional commits viewable in compare view

Updates chainguard-dev/actions from 1.6.13 to 1.6.14

Release notes

Sourced from chainguard-dev/actions's releases.

v1.6.14

What's Changed

Full Changelog: chainguard-dev/actions@v1.6.13...v1.6.14

Commits
  • de68b87 build(deps): bump step-security/harden-runner from 2.16.1 to 2.17.0 (#845)
  • af96613 build(deps): bump actions/github-script in /githubapp-token (#846)
  • 35ef116 chore(workflows): add github action linters [SECINT-75] (#844)
  • a0a960b build(deps): bump chainguard-dev/actions in /goimports (#840)
  • 06b7943 build(deps): bump chainguard-dev/actions in /inky-build-pkg (#841)
  • 14e76b5 build(deps): bump chainguard-dev/actions in /melange-build (#842)
  • 23d501f build(deps): bump chainguard-dev/actions in /wolfi-build-pkg (#843)
  • acb3c1e build(deps): bump chainguard-dev/actions from 1.6.11 to 1.6.13 in /gofmt (#839)
  • e7fcfbe build(deps): bump chainguard-dev/actions from 1.6.11 to 1.6.13 (#838)
  • See full diff in compare view

Updates peter-evans/create-pull-request from 8.1.0 to 8.1.1

Release notes

Sourced from peter-evans/create-pull-request's releases.

Create Pull Request v8.1.1

What's Changed

Full Changelog: peter-evans/create-pull-request@v8.1.0...v8.1.1

Commits
  • 5f6978f fix: retry post-creation API calls on 422 eventual consistency errors (#4356)
  • d32e88d build(deps-dev): bump the npm group with 3 updates (#4349)
  • 8170bcc build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 (#4344)
  • 0041819 build(deps): bump picomatch (#4339)
  • b993918 build(deps-dev): bump flatted from 3.3.1 to 3.4.2 (#4334)
  • 36d7c84 build(deps-dev): bump undici from 6.23.0 to 6.24.0 (#4328)
  • a45d1fb build(deps): bump @​tootallnate/once and jest-environment-jsdom (#4323)
  • 3499eb6 build(deps): bump the github-actions group with 2 updates (#4316)
  • 3f3b473 build(deps): bump minimatch (#4311)
  • 6699836 build(deps-dev): bump the npm group with 2 updates (#4305)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the actions group with 4 updates
f2e9557 
Bumps the actions group with 4 updates: [step-security/harden-runner](https://github.com/step-security/harden-runner), [step-security/action-actionlint](https://github.com/step-security/action-actionlint), [chainguard-dev/actions](https://github.com/chainguard-dev/actions) and [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request).


Updates `step-security/harden-runner` from 2.16.0 to 2.17.0
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@v2.16.0...f808768)

Updates `step-security/action-actionlint` from 1.69.1 to 1.72.0
- [Release notes](https://github.com/step-security/action-actionlint/releases)
- [Commits](step-security/action-actionlint@d364e70...c3aa382)

Updates `chainguard-dev/actions` from 1.6.13 to 1.6.14
- [Release notes](https://github.com/chainguard-dev/actions/releases)
- [Commits](chainguard-dev/actions@f45211d...de68b87)

Updates `peter-evans/create-pull-request` from 8.1.0 to 8.1.1
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](peter-evans/create-pull-request@c0f553f...5f6978f)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: step-security/action-actionlint
  dependency-version: 1.72.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: chainguard-dev/actions
  dependency-version: 1.6.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: peter-evans/create-pull-request
  dependency-version: 8.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Apr 13, 2026
@cpanato cpanato merged commit fcc8ca7 into main Apr 13, 2026
9 checks passed
@cpanato cpanato deleted the dependabot/github_actions/actions-bcfbba1f85 branch April 13, 2026 15:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cpanato cpanato cpanato approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@cpanato