Skip to content

build(deps): bump the actions group across 1 directory with 2 updates#135

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-25ab1ae5a3
Closed

build(deps): bump the actions group across 1 directory with 2 updates#135
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-25ab1ae5a3

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 4, 2026

Bumps the actions group with 2 updates in the / directory: step-security/harden-runner and chainguard-dev/actions.

Updates step-security/harden-runner from 2.19.0 to 2.19.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.19.1

What's Changed

What the fix changes

  • Harden-Runner will detect ubuntu-slim runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.

What the fix does not do

  • Jobs running on ubuntu-slim will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).
  • Per GitHub's docs on single-CPU runners: "The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported." Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.

For StepSecurity enterprise customers If your security posture requires that workflows are always monitored, you can block the use of ubuntu-slim via workflow run policies see the Runner Label Policy docs. This lets you enforce that jobs only run on monitored runner types.

New Contributors

Full Changelog: step-security/harden-runner@v2.19.0...v2.19.1

Commits
  • a5ad31d Merge pull request #657 from devantler/fix/ubuntu-slim-user-env
  • 6e92856 build dist and trim ubuntu-slim message
  • 4e0504e Merge branch 'main' into fix/ubuntu-slim-user-env
  • 376d25a fix: detect ubuntu-slim runners early and bail out
  • See full diff in compare view

Updates chainguard-dev/actions from 1.6.15 to 1.6.19

Release notes

Sourced from chainguard-dev/actions's releases.

v1.6.19

What's Changed

Full Changelog: chainguard-dev/actions@v1.6.18...v1.6.19

v1.6.18

What's Changed

Full Changelog: chainguard-dev/actions@v1.6.17...v1.6.18

v1.6.17

What's Changed

New Contributors

Full Changelog: chainguard-dev/actions@v1.6.16...v1.6.17

v1.6.16

What's Changed

... (truncated)

Commits
  • c69a264 otel-export: regenerate dist files (#879)
  • 22e1462 build(deps): bump chainguard-dev/actions from 1.6.17 to 1.6.18 in /gofmt (#888)
  • f857142 build(deps): bump step-security/harden-runner from 2.19.0 to 2.19.1 (#887)
  • a0c649b build(deps): bump chainguard-dev/actions in /goimports (#889)
  • 99fe914 build(deps): bump chainguard-dev/actions in /melange-build (#890)
  • d686fcc build(deps): bump chainguard-dev/actions from 1.6.17 to 1.6.18 (#886)
  • aa569d9 build(deps): bump chainguard-dev/actions in /wolfi-build-pkg (#891)
  • b57e4fe build(deps): bump chainguard-dev/actions in /inky-build-pkg (#892)
  • 4a81273 build(deps): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 (#870)
  • 00249eb build(deps): bump chainguard-dev/actions from 1.6.15 to 1.6.17 (#880)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 4, 2026
Bumps the actions group with 2 updates in the / directory: [step-security/harden-runner](https://github.com/step-security/harden-runner) and [chainguard-dev/actions](https://github.com/chainguard-dev/actions).


Updates `step-security/harden-runner` from 2.19.0 to 2.19.1
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@8d3c67d...a5ad31d)

Updates `chainguard-dev/actions` from 1.6.15 to 1.6.19
- [Release notes](https://github.com/chainguard-dev/actions/releases)
- [Commits](chainguard-dev/actions@061bc0e...c69a264)

---
updated-dependencies:
- dependency-name: chainguard-dev/actions
  dependency-version: 1.6.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: step-security/harden-runner
  dependency-version: 2.19.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/github_actions/actions-25ab1ae5a3 branch from 3685789 to 44d7ac5 Compare May 11, 2026 21:34
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 18, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this May 18, 2026
@dependabot dependabot Bot deleted the dependabot/github_actions/actions-25ab1ae5a3 branch May 18, 2026 23:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants