Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 5, 2026

Bumps the actions group with 8 updates in the / directory:

Package From To
actions/checkout 4.1.1 6.0.2
github/codeql-action 4.31.9 4.32.1
erlef/setup-beam 1.17.5 1.20.4
actions/github-script 7.0.1 8.0.0
docker/login-action 3.3.0 3.7.0
docker/metadata-action 5.5.1 5.10.0
docker/build-push-action 6.9.0 6.18.0
trufflesecurity/trufflehog 3.92.4 3.93.0

Updates actions/checkout from 4.1.1 to 6.0.2

Release notes

Sourced from actions/checkout's releases.

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

... (truncated)

Commits

Updates github/codeql-action from 4.31.9 to 4.32.1

Release notes

Sourced from github/codeql-action's releases.

v4.32.1

  • A warning is now shown in Default Setup workflow logs if a private package registry is configured using a GitHub Personal Access Token (PAT), but no username is configured. #3422
  • Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. #3421

v4.32.0

  • Update default CodeQL bundle version to 2.24.0. #3425

v4.31.11

  • When running a Default Setup workflow with Actions debugging enabled, the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. #3409
  • Improved error handling throughout the CodeQL Action. #3415
  • Added experimental support for automatically excluding generated files from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. #3318
  • The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. #3403

v4.31.10

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.10 - 12 Jan 2026

  • Update default CodeQL bundle version to 2.23.9. #3393

See the full CHANGELOG.md for more information.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.32.1 - 02 Feb 2026

  • A warning is now shown in Default Setup workflow logs if a private package registry is configured using a GitHub Personal Access Token (PAT), but no username is configured. #3422
  • Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. #3421

4.32.0 - 26 Jan 2026

  • Update default CodeQL bundle version to 2.24.0. #3425

4.31.11 - 23 Jan 2026

  • When running a Default Setup workflow with Actions debugging enabled, the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. #3409
  • Improved error handling throughout the CodeQL Action. #3415
  • Added experimental support for automatically excluding generated files from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. #3318
  • The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. #3403

4.31.10 - 12 Jan 2026

  • Update default CodeQL bundle version to 2.23.9. #3393

4.31.9 - 16 Dec 2025

No user facing changes.

4.31.8 - 11 Dec 2025

  • Update default CodeQL bundle version to 2.23.8. #3354

4.31.7 - 05 Dec 2025

  • Update default CodeQL bundle version to 2.23.7. #3343

4.31.6 - 01 Dec 2025

No user facing changes.

4.31.5 - 24 Nov 2025

  • Update default CodeQL bundle version to 2.23.6. #3321

4.31.4 - 18 Nov 2025

... (truncated)

Commits
  • 6bc82e0 Merge pull request #3447 from github/update-v4.32.1-f52cbc830
  • 42f00f2 Add a couple of change notes
  • cedee6d Update changelog for v4.32.1
  • f52cbc8 Merge pull request #3445 from github/dependabot/npm_and_yarn/fast-xml-parser-...
  • c5aaca4 Merge pull request #3446 from github/mbg/ci/pin-node-packages
  • 3e58739 Pin @actions/tool-cache@3 in workflows to avoid failures with github-script
  • a6ccefb Rebuild
  • 0e64858 Bump fast-xml-parser from 5.3.3 to 5.3.4
  • f985be5 Merge pull request #3443 from github/dependabot/npm_and_yarn/tar-7.5.7
  • 0c8e06d Bump tar from 7.5.6 to 7.5.7
  • Additional commits viewable in compare view

Updates erlef/setup-beam from 1.17.5 to 1.20.4

Release notes

Sourced from erlef/setup-beam's releases.

v1.20.4

What's Changed

Dependabot updates

Full Changelog: erlef/setup-beam@v1.20.3...v1.20.4

v1.20.3

What's Changed

Full Changelog: erlef/setup-beam@v1.20...v1.20.3

v1.20.2

What's Changed

Full Changelog: erlef/setup-beam@v1.20...v1.20.2

v1.20.1

What's Changed

Full Changelog: erlef/setup-beam@v1...v1.20.1

v1.20.0

What's Changed

@​dependabot

... (truncated)

Commits
  • e6d7c94 Automation: update setup-beam version output to fceaea9
  • fceaea9 Fix: more versioning around nightly and maint/main (#359)
  • 2bb5b65 Automation: update setup-beam version output to 1d4efdd
  • 1d4efdd Bump globals from 16.2.0 to 16.3.0 (#361)
  • 73f047e Automation: update setup-beam version output to 6dd8a1a
  • 6dd8a1a Bump @​eslint/js from 9.30.0 to 9.30.1 (#360)
  • fd9a2e1 Automation: update setup-beam version output to 65085e3
  • 65085e3 Bump eslint from 9.30.0 to 9.30.1 (#362)
  • 80c1659 Automation: update setup-beam version output to 8e7fdef
  • 8e7fdef Automation: update setup-beam version output to 1fe9179
  • Additional commits viewable in compare view

Updates actions/github-script from 7.0.1 to 8.0.0

Release notes

Sourced from actions/github-script's releases.

v8.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

New Contributors

Full Changelog: actions/github-script@v7.1.0...v8.0.0

v7.1.0

What's Changed

New Contributors

Full Changelog: actions/github-script@v7...v7.1.0

Commits
  • ed59741 Merge pull request #653 from actions/sneha-krip/readme-for-v8
  • 2dc352e Bold minimum Actions Runner version in README
  • 01e118c Update README for Node 24 runtime requirements
  • 8b222ac Apply suggestion from @​salmanmkc
  • adc0eea README for updating actions/github-script from v7 to v8
  • 20fe497 Merge pull request #637 from actions/node24
  • e7b7f22 update licenses
  • 2c81ba0 Update Node.js version support to 24.x
  • f28e40c Merge pull request #610 from actions/nebuk89-patch-1
  • 1ae9958 Update README.md
  • Additional commits viewable in compare view

Updates docker/login-action from 3.3.0 to 3.7.0

Release notes

Sourced from docker/login-action's releases.

v3.7.0

Full Changelog: docker/login-action@v3.6.0...v3.7.0

v3.6.0

Full Changelog: docker/login-action@v3.5.0...v3.6.0

v3.5.0

Full Changelog: docker/login-action@v3.4.0...v3.5.0

v3.4.0

Full Changelog: docker/login-action@v3.3.0...v3.4.0

Commits
  • c94ce9f Merge pull request #915 from docker/dependabot/npm_and_yarn/lodash-4.17.23
  • 8339c95 Merge pull request #912 from docker/scope
  • c83e932 build(deps): bump lodash from 4.17.21 to 4.17.23
  • b268aa5 chore: update generated content
  • a603229 documentation for scope input
  • 7567f92 Add scope input to set scopes for the authentication token
  • 0567fa5 Merge pull request #914 from dphi/add-support-for-amazonaws.eu
  • f6ef577 feat: add support for AWS European Sovereign Cloud ECR registries
  • 916386b Merge pull request #911 from crazy-max/ensure-redact
  • 5b3f94a chore: update generated content
  • Additional commits viewable in compare view

Updates docker/metadata-action from 5.5.1 to 5.10.0

Release notes

Sourced from docker/metadata-action's releases.

v5.10.0

Full Changelog: docker/metadata-action@v5.9.0...v5.10.0

v5.9.0

Full Changelog: docker/metadata-action@v5.8.0...v5.9.0

v5.8.0

Full Changelog: docker/metadata-action@v5.7.0...v5.8.0

v5.7.0

Full Changelog: docker/metadata-action@v5.6.1...v5.7.0

v5.6.1

Full Changelog: docker/metadata-action@v5.6.0...v5.6.1

v5.6.0

... (truncated)

Commits
  • c299e40 Merge pull request #569 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • f015d79 chore: update generated content
  • 121bcc2 chore(deps): Bump @​docker/actions-toolkit from 0.67.0 to 0.68.0
  • f7b6bf4 Merge pull request #564 from docker/dependabot/npm_and_yarn/js-yaml-3.14.2
  • 0b95c6b Merge pull request #565 from docker/dependabot/github_actions/actions/checkout-6
  • 17f70d7 Merge pull request #568 from motoki317/docs/fix-to-24h-schedule-pattern
  • afd7e6d docs(README): Fix date format from 12h to 24h in schedule pattern
  • 602aff8 chore(deps): Bump actions/checkout from 5 to 6
  • aecb1a4 chore(deps): Bump js-yaml from 3.14.1 to 3.14.2
  • 8d8c7c1 Merge pull request #559 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • Additional commits viewable in compare view

Updates docker/build-push-action from 6.9.0 to 6.18.0

Release notes

Sourced from docker/build-push-action's releases.

v6.18.0

[!NOTE] Build summary is now supported with Docker Build Cloud.

Full Changelog: docker/build-push-action@v6.17.0...v6.18.0

v6.17.0

[!NOTE] Build record is now exported using the buildx history export command instead of the legacy export-build tool.

Full Changelog: docker/build-push-action@v6.16.0...v6.17.0

v6.16.0

Full Changelog: docker/build-push-action@v6.15.0...v6.16.0

v6.15.0

Full Changelog: docker/build-push-action@v6.14.0...v6.15.0

v6.14.0

Full Changelog: docker/build-push-action@v6.13.0...v6.14.0

v6.13.0

Full Changelog: docker/build-push-action@v6.12.0...v6.13.0

v6.12.0

Full Changelog: docker/build-push-action@v6.11.0...v6.12.0

v6.11.0

Full Changelog: docker/build-push-action@v6.10.0...v6.11.0

v6.10.0

... (truncated)

Commits
  • 2634353 Merge pull request #1381 from docker/dependabot/npm_and_yarn/docker/actions-t...
  • c0432d2 chore: update generated content
  • 0bb1f27 set builder driver and endpoint attributes for dbc summary support
  • 5f9dbf9 chore(deps): Bump @​docker/actions-toolkit from 0.61.0 to 0.62.1
  • 0788c44 Merge pull request #1375 from crazy-max/remove-gcr
  • aa179ca e2e: remove GCR
  • 1dc7386 Merge pull request #1364 from crazy-max/history-export-cmd
  • 9c9803f chore: update generated content
  • db1f6c4 DOCKER_BUILD_EXPORT_LEGACY env var to opt-in for legacy export
  • 721e8c7 Bump @​docker/actions-toolkit from 0.59.0 to 0.61.0
  • Additional commits viewable in compare view

Updates trufflesecurity/trufflehog from 3.92.4 to 3.93.0

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.93.0

What's Changed

@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Feb 5, 2026
@chatgpt-codex-connector
Copy link

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

Bumps the actions group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.1.1` | `6.0.2` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.31.9` | `4.32.1` |
| [erlef/setup-beam](https://github.com/erlef/setup-beam) | `1.17.5` | `1.20.4` |
| [actions/github-script](https://github.com/actions/github-script) | `7.0.1` | `8.0.0` |
| [docker/login-action](https://github.com/docker/login-action) | `3.3.0` | `3.7.0` |
| [docker/metadata-action](https://github.com/docker/metadata-action) | `5.5.1` | `5.10.0` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `6.9.0` | `6.18.0` |
| [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) | `3.92.4` | `3.93.0` |



Updates `actions/checkout` from 4.1.1 to 6.0.2
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v4.1.1...v6.0.2)

Updates `github/codeql-action` from 4.31.9 to 4.32.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@5d4e8d1...6bc82e0)

Updates `erlef/setup-beam` from 1.17.5 to 1.20.4
- [Release notes](https://github.com/erlef/setup-beam/releases)
- [Commits](erlef/setup-beam@2f0cc07...e6d7c94)

Updates `actions/github-script` from 7.0.1 to 8.0.0
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@60a0d83...ed59741)

Updates `docker/login-action` from 3.3.0 to 3.7.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@9780b0c...c94ce9f)

Updates `docker/metadata-action` from 5.5.1 to 5.10.0
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@8e5442c...c299e40)

Updates `docker/build-push-action` from 6.9.0 to 6.18.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@4f58ea7...2634353)

Updates `trufflesecurity/trufflehog` from 3.92.4 to 3.93.0
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@ef6e76c...7f4e37d)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: github/codeql-action
  dependency-version: 4.32.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: erlef/setup-beam
  dependency-version: 1.20.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/github-script
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: docker/login-action
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: docker/metadata-action
  dependency-version: 5.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: docker/build-push-action
  dependency-version: 6.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.93.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/github_actions/actions-952b9a50f0 branch from 8ca5855 to 4791125 Compare February 9, 2026 06:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants