build(deps): bump the actions-minor-patch group with 3 updates by dependabot[bot] · Pull Request #123 · neondatabase/schema-diff-action

dependabot · 2026-05-12T11:53:46Z

Bumps the actions-minor-patch group with 3 updates: step-security/harden-runner, oven-sh/setup-bun and super-linter/super-linter.

Updates step-security/harden-runner from 2.13.1 to 2.19.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.19.1

What's Changed

fix: detect ubuntu-slim runners early and bail out by @devantler in step-security/harden-runner#657

What the fix changes

Harden-Runner will detect ubuntu-slim runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.

What the fix does not do

Jobs running on ubuntu-slim will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).

Per GitHub's docs on single-CPU runners: "The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported." Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.

For StepSecurity enterprise customers If your security posture requires that workflows are always monitored, you can block the use of ubuntu-slim via workflow run policies see the Runner Label Policy docs. This lets you enforce that jobs only run on monitored runner types.

New Contributors

@devantler made their first contribution in step-security/harden-runner#657

Full Changelog: step-security/harden-runner@v2.19.0...v2.19.1

v2.19.0

What's Changed

New Runner Support

Harden-Runner now supports Depot, Blacksmith, Namespace, and WarpBuild runners with the same egress monitoring, runtime monitoring, and policy enforcement available on GitHub-hosted runners.

Automated Incident Response for Supply Chain Attacks

Global block list: Outbound connections to known malicious domains and IPs are now blocked even in audit mode.

System-defined detection rules: Harden-Runner will trigger lockdown mode when a high risk event is detected during an active supply chain attack (for example, a process reading the memory of the runner worker process, a common technique for stealing GitHub Actions secrets).

Bug Fixes

Windows and macOS: stability and reliability fixes

Full Changelog: step-security/harden-runner@v2.18.0...v2.19.0

v2.18.0

What's Changed

Global Block List: During supply chain incidents like the recent axios and trivy compromises, StepSecurity will add known malicious domains and IP addresses (IOCs) to a global block list. These will be automatically blocked, even in audit mode, providing immediate protection without requiring any workflow changes.

Deploy on Self-Hosted VM: Added deploy-on-self-hosted-vm input that allows the Harden Runner agent to be installed directly on ephemeral self-hosted Linux runner VMs at workflow runtime. This is intended as an alternative when baking the agent into the VM image is not possible.

Full Changelog: step-security/harden-runner@v2.17.0...v2.18.0

v2.17.0

What's Changed

Policy Store Support

Added use-policy-store and api-key inputs to fetch security policies directly from the StepSecurity Policy Store. Policies can be defined and attached at the workflow, repo, org, or cluster (ARC) level, with the most granular policy taking precedence. This is the preferred method over the existing policy input which requires id-token: write permission. If no policy is found in the store, the action defaults to audit mode.

Full Changelog: step-security/harden-runner@v2.16.1...v2.17.0

v2.16.1

... (truncated)

Commits

a5ad31d Merge pull request #657 from devantler/fix/ubuntu-slim-user-env
6e92856 build dist and trim ubuntu-slim message
4e0504e Merge branch 'main' into fix/ubuntu-slim-user-env
8d3c67d Release v2.19.0 (#661)
6c3c2f2 Feature/deploy on self hosted vm (#658)
376d25a fix: detect ubuntu-slim runners early and bail out
f808768 Feature/policy store (#656)
fe10465 v2.16.1 (#654)
fa2e9d6 Release v2.16.0 (#646)
58077d3 Release v2.15.1 (#641)
Additional commits viewable in compare view

Updates oven-sh/setup-bun from 2.0.2 to 2.2.0

Release notes

Sourced from oven-sh/setup-bun's releases.

v2.2.0

oven-sh/setup-bun is the github action for setting up Bun.

What's Changed

build: update action runtime to Node.js 24 by @adam0white in oven-sh/setup-bun#176

ci: use actions/checkout@v6.0.2 in the test workflow by @tcely in oven-sh/setup-bun#173

ci: update actions for the autofix.ci workflow by @tcely in oven-sh/setup-bun#174

ci: update actions for the Release new action version workflow by @tcely in oven-sh/setup-bun#175

release: v2.2.0 by @xhyrom in oven-sh/setup-bun#177

New Contributors

@adam0white made their first contribution in oven-sh/setup-bun#176

@tcely made their first contribution in oven-sh/setup-bun#173

Full Changelog: oven-sh/setup-bun@v2...v2.2.0

v2.1.3

oven-sh/setup-bun is the github action for setting up Bun.

What's Changed

perf: avoid unnecessary api calls by @xhyrom in oven-sh/setup-bun#161

feat: add bun- prefix to cache keys by @maschwenk in oven-sh/setup-bun#160

fix: use native Windows ARM64 binary for Bun >= 1.3.10 by @oddrationale in oven-sh/setup-bun#165

feat: add AVX2 support detection for x64 Linux systems by @GoForceX in oven-sh/setup-bun#167

fix: validate cached binary version matches requested version (#146) by @wyMinLwin in oven-sh/setup-bun#169

release: v2.1.3 by @xhyrom in oven-sh/setup-bun#170

New Contributors

@oddrationale made their first contribution in oven-sh/setup-bun#165

@GoForceX made their first contribution in oven-sh/setup-bun#167

@wyMinLwin made their first contribution in oven-sh/setup-bun#169

Full Changelog: oven-sh/setup-bun@v2...v2.1.3

v2.1.2

oven-sh/setup-bun is the github action for setting up Bun.

What's Changed

fix: default token only on public github instance by @xhyrom in oven-sh/setup-bun#157

Full Changelog: oven-sh/setup-bun@v2...v2.1.2

v2.1.1

oven-sh/setup-bun is the github action for setting up Bun.

What's Changed

feat: implement wildcard resolution into the action by @xhyrom in oven-sh/setup-bun#93

feat: fallback arm64 to x64 architecture for win32 platform by @xhyrom in oven-sh/setup-bun#131

feat: use packageManager from package.json as default bun version by @xhyrom in oven-sh/setup-bun#152

... (truncated)

Commits

0c5077e release: v2.2.0 (#177)
1255e43 ci: update actions for the Release new action version workflow (#175)
61861d1 ci: update actions for the autofix.ci workflow (#174)
6f5bd06 ci: use actions/checkout@v6.0.2 in the test workflow (#173)
e391475 build: update action runtime to Node.js 24 (#176)
ecf28dd release: v2.1.3 (#170)
95edc15 fix: validate cached binary version matches requested version (#146) (#169)
4c32875 feat: add AVX2 support detection for x64 Linux systems (#167)
0ff83bf fix: use native Windows ARM64 binary for Bun >= 1.3.10 (#165)
ab8cb4e feat: add bun- prefix to cache keys (#160)
Additional commits viewable in compare view

Updates super-linter/super-linter from 8.1.0 to 8.6.0

Release notes

Sourced from super-linter/super-linter's releases.

v8.6.0

8.6.0 (2026-03-31)

🚀 Features

improve zsh scripts support (#7674) (6a65d3a), closes #7618

🐛 Bugfixes

exclude zsh scripts from file list (#7536) (d0e883c)

set markdownlint glob paths from rules file (#7652) (53eb3bb), closes #7650

unset log level when getting renovate version (#7594) (72c2bd7)

⬆️ Dependency updates

bundler: bump rubocop in /dependencies in the rubocop group (#7514) (f2264d2)

bundler: bump rubocop in /dependencies in the rubocop group (#7604) (c929dc3)

bundler: bump rubocop in /dependencies in the rubocop group (#7662) (bfb2fd9)

bundler: bump rubocop-github in /dependencies in the rubocop group (#7640) (a88d75e)

bundler: bump the rubocop group across 1 directory with 2 updates (#7565) (56ae6b3)

docker: bump python in the docker-base-images group (#7319) (717c087)

docker: bump the docker group across 1 directory with 4 updates (#7698) (11c750e)

docker: bump the docker group across 1 directory with 5 updates (#7615) (d7e1bd8)

docker: bump the docker group across 1 directory with 6 updates (#7566) (0f9cf19)

docker: bump the docker group across 1 directory with 6 updates (#7631) (ad7f508)

docker: bump the docker group across 1 directory with 9 updates (#7513) (89e3725)

docker: bump the docker group with 2 updates (#7577) (8b2f0c0)

docker: bump the docker group with 2 updates (#7641) (7293e37)

docker: bump the docker group with 2 updates (#7663) (eabfa25)

java: bump com.puppycrawl.tools:checkstyle (#7689) (4c66d9d)

java: bump the java-gradle group across 2 directories with 2 updates (#7581) (51af5a0)

npm: bump ajv from 6.12.6 to 6.14.0 in /dependencies (#7550) (7f00eb7)

npm: bump axios from 1.12.2 to 1.13.5 in /dependencies (#7510) (a891169)

npm: bump brace-expansion from 1.1.12 to 1.1.13 in /dependencies (#7685) (92c4cea)

npm: bump express-rate-limit from 8.2.1 to 8.3.0 in /dependencies (#7613) (c184a25)

npm: bump flatted from 3.3.3 to 3.4.1 in /dependencies (#7636) (013d8a7)

npm: bump hono from 4.11.7 to 4.12.2 in /dependencies (#7559) (5c3679f)

npm: bump hono from 4.12.5 to 4.12.7 in /dependencies (#7624) (c31d9ad)

npm: bump markdown-it and renovate in /dependencies (#7529) (9b794c2)

npm: bump path-to-regexp from 8.3.0 to 8.4.0 in /dependencies (#7687) (309fb55)

npm: bump picomatch in /dependencies (#7675) (df4f15e)

npm: bump qs from 6.14.1 to 6.14.2 in /dependencies (#7520) (a9e6534)

npm: bump renovate (#7699) (b91627f)

npm: bump renovate from 43.4.0 to 43.4.4 in /dependencies (#7524) (2ab5b9c)

npm: bump smol-toml from 1.6.0 to 1.6.1 in /dependencies (#7676) (d015498)

npm: bump the npm group across 1 directory with 15 updates (#7595) (58ee821)

npm: bump the npm group across 1 directory with 2 updates (#7623) (ddb4fbb)

... (truncated)

Changelog

Sourced from super-linter/super-linter's changelog.

Changelog

8.6.0 (2026-03-31)

🚀 Features

improve zsh scripts support (#7674) (6a65d3a), closes #7618

🐛 Bugfixes

exclude zsh scripts from file list (#7536) (d0e883c)

set markdownlint glob paths from rules file (#7652) (53eb3bb), closes #7650

unset log level when getting renovate version (#7594) (72c2bd7)

⬆️ Dependency updates

bundler: bump rubocop in /dependencies in the rubocop group (#7514) (f2264d2)

bundler: bump rubocop in /dependencies in the rubocop group (#7604) (c929dc3)

bundler: bump rubocop in /dependencies in the rubocop group (#7662) (bfb2fd9)

bundler: bump rubocop-github in /dependencies in the rubocop group (#7640) (a88d75e)

bundler: bump the rubocop group across 1 directory with 2 updates (#7565) (56ae6b3)

docker: bump python in the docker-base-images group (#7319) (717c087)

docker: bump the docker group across 1 directory with 4 updates (#7698) (11c750e)

docker: bump the docker group across 1 directory with 5 updates (#7615) (d7e1bd8)

docker: bump the docker group across 1 directory with 6 updates (#7566) (0f9cf19)

docker: bump the docker group across 1 directory with 6 updates (#7631) (ad7f508)

docker: bump the docker group across 1 directory with 9 updates (#7513) (89e3725)

docker: bump the docker group with 2 updates (#7577) (8b2f0c0)

docker: bump the docker group with 2 updates (#7641) (7293e37)

docker: bump the docker group with 2 updates (#7663) (eabfa25)

java: bump com.puppycrawl.tools:checkstyle (#7689) (4c66d9d)

java: bump the java-gradle group across 2 directories with 2 updates (#7581) (51af5a0)

npm: bump ajv from 6.12.6 to 6.14.0 in /dependencies (#7550) (7f00eb7)

npm: bump axios from 1.12.2 to 1.13.5 in /dependencies (#7510) (a891169)

npm: bump brace-expansion from 1.1.12 to 1.1.13 in /dependencies (#7685) (92c4cea)

npm: bump express-rate-limit from 8.2.1 to 8.3.0 in /dependencies (#7613) (c184a25)

npm: bump flatted from 3.3.3 to 3.4.1 in /dependencies (#7636) (013d8a7)

npm: bump hono from 4.11.7 to 4.12.2 in /dependencies (#7559) (5c3679f)

npm: bump hono from 4.12.5 to 4.12.7 in /dependencies (#7624) (c31d9ad)

npm: bump markdown-it and renovate in /dependencies (#7529) (9b794c2)

npm: bump path-to-regexp from 8.3.0 to 8.4.0 in /dependencies (#7687) (309fb55)

npm: bump picomatch in /dependencies (#7675) (df4f15e)

npm: bump qs from 6.14.1 to 6.14.2 in /dependencies (#7520) (a9e6534)

npm: bump renovate (#7699) (b91627f)

npm: bump renovate from 43.4.0 to 43.4.4 in /dependencies (#7524) (2ab5b9c)

npm: bump smol-toml from 1.6.0 to 1.6.1 in /dependencies (#7676) (d015498)

npm: bump the npm group across 1 directory with 15 updates (#7595) (58ee821)

... (truncated)

Commits

9e86335 chore(main): release 8.6.0 (#7512)
b91627f deps(npm): bump renovate (#7699)
11c750e deps(docker): bump the docker group across 1 directory with 4 updates (#7698)
4c66d9d deps(java): bump com.puppycrawl.tools:checkstyle (#7689)
cb17f60 deps(python): bump the pip group across 1 directory with 5 updates (#7684)
6a65d3a feat: improve zsh scripts support (#7674)
eb8ddc7 chore: update ruby and npm deps (#7694)
db85efc deps(npm): bump the npm group across 1 directory with 9 updates (#7690)
c5ec78d ci(dev-npm): bump the npm_and_yarn group across 1 directory with 1 update (#7...
f35a407 ci(dev-docker): bump node in /dev-dependencies (#7678)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions-minor-patch group with 3 updates: [step-security/harden-runner](https://github.com/step-security/harden-runner), [oven-sh/setup-bun](https://github.com/oven-sh/setup-bun) and [super-linter/super-linter](https://github.com/super-linter/super-linter). Updates `step-security/harden-runner` from 2.13.1 to 2.19.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@f4a75cf...a5ad31d) Updates `oven-sh/setup-bun` from 2.0.2 to 2.2.0 - [Release notes](https://github.com/oven-sh/setup-bun/releases) - [Commits](oven-sh/setup-bun@735343b...0c5077e) Updates `super-linter/super-linter` from 8.1.0 to 8.6.0 - [Release notes](https://github.com/super-linter/super-linter/releases) - [Changelog](https://github.com/super-linter/super-linter/blob/main/CHANGELOG.md) - [Commits](super-linter/super-linter@ffde3b2...9e86335) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.19.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor-patch - dependency-name: oven-sh/setup-bun dependency-version: 2.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor-patch - dependency-name: super-linter/super-linter dependency-version: 8.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 12, 2026

dependabot Bot requested a review from a team as a code owner May 12, 2026 11:53

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 12, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the actions-minor-patch group with 3 updates#123

build(deps): bump the actions-minor-patch group with 3 updates#123
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-minor-patch-9bd1a82e9d

dependabot Bot commented on behalf of github May 12, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.19.1

What's Changed

New Contributors

v2.19.0

What's Changed

New Runner Support

Automated Incident Response for Supply Chain Attacks

Bug Fixes

v2.18.0

What's Changed

v2.17.0

What's Changed

Policy Store Support

v2.16.1

v2.2.0

What's Changed

New Contributors

v2.1.3

What's Changed

New Contributors

v2.1.2

What's Changed

v2.1.1

What's Changed

v8.6.0

8.6.0 (2026-03-31)

🚀 Features

🐛 Bugfixes

⬆️ Dependency updates

Changelog

8.6.0 (2026-03-31)

🚀 Features

🐛 Bugfixes

⬆️ Dependency updates

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github May 12, 2026 •

edited

Loading