chore(deps): bump the actions-minor-patch group across 1 directory with 4 updates - #989
Open
dependabot[bot] wants to merge 1 commit into
Open
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
…th 4 updates Bumps the actions-minor-patch group with 4 updates in the / directory: [pnpm/action-setup](https://github.com/pnpm/action-setup), [github/codeql-action](https://github.com/github/codeql-action), [google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml](https://github.com/google/osv-scanner-action) and [release-plz/action](https://github.com/release-plz/action). Updates `pnpm/action-setup` from 6.0.10 to 6.1.0 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@v6.0.10...v6.1.0) Updates `github/codeql-action` from 4.37.8 to 4.38.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4.37.8...v4.38.0) Updates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml` from 2.5.1 to 2.6.0 - [Release notes](https://github.com/google/osv-scanner-action/releases) - [Commits](google/osv-scanner-action@v2.5.1...v2.6.0) Updates `release-plz/action` from 0.5.131 to 0.5.137 - [Release notes](https://github.com/release-plz/action/releases) - [Commits](release-plz/action@2eb1d8b...8e61445) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor-patch - dependency-name: github/codeql-action dependency-version: 4.38.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor-patch - dependency-name: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml dependency-version: 2.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor-patch - dependency-name: release-plz/action dependency-version: 0.5.137 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
freshtonic
approved these changes
Sep 23, 2026
freshtonic
left a comment
freshtonic
left a comment
Contributor
There was a problem hiding this comment.
Approved. This PR bumps CI actions only (minor and patch versions). No published package changes, so no changeset is necessary. All required checks pass.
What I verified
pnpm/action-setupv6.0.10 → v6.1.0. The pinned SHA inrelease.yml(ea17c68d…) is the commit that the upstreamv6.1.0tag points to. The only upstream change adds support for pnpm v12. It does not change thecacheorrun_installinputs, solint-no-workflow-cachingand the node-gyp steps stay valid.release-plz/action2eb1d8bc…→8e61445f…. This commit is the upstreamv0.5.137tag. It is a fast-forward (61 commits ahead, 0 behind). It moves the default release-plz binary from 0.3.160 to 0.3.167, and it now sends--forge githubexplicitly. This workflow sets noforgeorbackendinput, so the result is the same. Also, the EQL release pipeline is still inert.github/codeql-actionv4.37.8 → v4.38.0 andgoogle/osv-scanner-actionv2.5.1 → v2.6.0. Both are minor bumps with no input changes that this repo uses.
Non-blocking follow-ups (these problems existed before this PR)
.github/workflows/codeql.yml: the "Perform CodeQL Analysis" step callsgithub/codeql-action/init, notgithub/codeql-action/analyze. As a result, the job initialises CodeQL two times and does no analysis, but the check still shows green. This PR bumps that line but does not cause the problem. A separate fix is necessary..github/actions/integration-setup/action.ymlstill pinspnpm/action-setup@v6.0.9. Withdirectory: /, Dependabot does not scan composite actions under.github/actions/, so this pin will continue to fall behind. To include it, change the github-actions entry independabot.ymltodirectories: ["/", "/.github/actions/*"].- Small point: the
# v0.5comment on the release-plz pin refers to a tag that moves.# v0.5.137identifies the pinned commit exactly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions-minor-patch group with 4 updates in the / directory: pnpm/action-setup, github/codeql-action, google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml and release-plz/action.
Updates
pnpm/action-setupfrom 6.0.10 to 6.1.0Release notes
Sourced from pnpm/action-setup's releases.
Commits
ea17c68feat: support pnpm v12 (#288)Updates
github/codeql-actionfrom 4.37.8 to 4.38.0Release notes
Sourced from github/codeql-action's releases.
Changelog
Sourced from github/codeql-action's changelog.
Commits
b96794fMerge pull request #4131 from github/update-v4.38.0-7e08580a902d5093Update changelog for v4.38.07e08580Merge pull request #4130 from github/henrymercer/workflow-runner-sizingbfcc52bRun slow macOS checks on larger runners8c251e7Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.00b7ca40Add changelog note40484b3Update default bundle to codeql-bundle-v2.27.0977e6ceMerge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup40a6b38Address toolcache cleanup review feedbackdeece8fApply suggestion from@henrymercerUpdates
google/osv-scanner-action/.github/workflows/osv-scanner-reusable.ymlfrom 2.5.1 to 2.6.0Release notes
Sourced from google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml's releases.
Commits
a345acfMerge pull request #144 from google/update-to-v2.6.06b289e0Update unified workflow example to point to v2.6.0 reusable workflowsc7c7bcbUpdate reusable workflows to point to v2.6.0 actions7f58dd6"Update actions to use v2.6.0 osv-scanner image"8e5cf47Merge pull request #139 from alimony/fail-closed-on-incomplete-scanbf5f924Merge remote-tracking branch 'upstream/main' into fail-closed-on-incomplete-scanffa0a5fMerge pull request #142 from google/fix-json-export-code259ba4aFix JSON results exportd291480Check for file size as well2dff55cFail the job when a scan does not completeUpdates
release-plz/actionfrom 0.5.131 to 0.5.137Release notes
Sourced from release-plz/action's releases.
... (truncated)
Commits
8e61445Update to 0.3.167 (#531)c9cf542chore(deps): update dependency taiki-e/install-action to v2.87.12 (#530)c4d7bf6fix: support Gitea runners without GitHub identity lookup (#528)825b14achore(deps): update dependency taiki-e/install-action to v2.87.11 (#529)4745e52chore(deps): update dependency taiki-e/install-action to v2.87.10 (#526)a80d79eUpdate to 0.3.165 (#525)346832dUpdate to 0.3.164 (#523)9355587chore(deps): update dependency taiki-e/install-action to v2.87.9 (#524)503fe65Update to 0.3.163 (#522)2250570chore(deps): update dependency taiki-e/install-action to v2.87.8 (#521)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions