Skip to content

chore(ci): bump the actions-minor-and-patch group across 1 directory with 5 updates - #1

Merged
stephrobert merged 1 commit into
mainfrom
dependabot/github_actions/actions-minor-and-patch-6fbde6c6a3
Oct 9, 2026
Merged

chore(ci): bump the actions-minor-and-patch group across 1 directory with 5 updates#1
stephrobert merged 1 commit into
mainfrom
dependabot/github_actions/actions-minor-and-patch-6fbde6c6a3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the actions-minor-and-patch group with 5 updates in the / directory:

Package From To
astral-sh/setup-uv 10.1.0 10.2.0
github/codeql-action/init 4.38.1 4.38.2
github/codeql-action/analyze 4.38.1 4.38.2
getplumber/plumber 0.5.2 0.5.18
github/codeql-action/upload-sarif 4.38.1 4.38.2

Updates astral-sh/setup-uv from 10.1.0 to 10.2.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.2.0 🌈 Disable automatic cache saves for merge queues

Changes

This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

Commits

Updates github/codeql-action/init from 4.38.1 to 4.38.2

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.2

  • Update default CodeQL bundle version to 2.27.1. #4160
Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.3 - 08 Oct 2026

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

  • Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

... (truncated)

Commits
  • 2892aa5 Merge pull request #4168 from github/update-v4.38.2-a6ef2c96f
  • 8ad03a3 Trigger workflows
  • 98af865 Update changelog for v4.38.2
  • a6ef2c9 Merge pull request #4156 from github/mario-campos/fix-validate-cmd
  • 1ef28a1 Merge pull request #4166 from github/dependabot/github_actions/dot-github/wor...
  • 26cb08b Merge pull request #4163 from github/mbg/fix-getCommitOid-stubs
  • f035ce3 Merge pull request #4165 from github/dependabot/npm_and_yarn/npm-minor-8eaed9...
  • 5e4e255 Rebuild
  • b13f5f4 Bump ruby/setup-ruby
  • c87fe57 Rebuild
  • Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.38.1 to 4.38.2

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.38.2

  • Update default CodeQL bundle version to 2.27.1. #4160
Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.3 - 08 Oct 2026

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

  • Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

... (truncated)

Commits
  • 2892aa5 Merge pull request #4168 from github/update-v4.38.2-a6ef2c96f
  • 8ad03a3 Trigger workflows
  • 98af865 Update changelog for v4.38.2
  • a6ef2c9 Merge pull request #4156 from github/mario-campos/fix-validate-cmd
  • 1ef28a1 Merge pull request #4166 from github/dependabot/github_actions/dot-github/wor...
  • 26cb08b Merge pull request #4163 from github/mbg/fix-getCommitOid-stubs
  • f035ce3 Merge pull request #4165 from github/dependabot/npm_and_yarn/npm-minor-8eaed9...
  • 5e4e255 Rebuild
  • b13f5f4 Bump ruby/setup-ruby
  • c87fe57 Rebuild
  • Additional commits viewable in compare view

Updates getplumber/plumber from 0.5.2 to 0.5.18

Release notes

Sourced from getplumber/plumber's releases.

v0.5.18

0.5.18 (2026-10-02)

✨ Features

  • github: collect the repository visibility into the pipeline (0f8e228)
  • github: jobs carry runs-on, needs, caches and artifacts (7d98eff)
  • gitlab: copy the project visibility onto the pipeline (6f3c660)
  • gitlab: jobs carry needs, caches, artifacts and environment (b40dcc5)
  • ir: visibility, runs-on, needs, caches and artifacts on the pipeline model (9bd2d5a)

📚 Documentation

  • readme: use the official Resty logo in the adopters row (40125a7)

v0.5.17

0.5.17 (2026-10-02)

✨ Features

  • analyze: accept the repository to scan as a positional target (14f3908)

📚 Documentation

  • show the positional target in the remote-scan examples (c991a47)

v0.5.16

0.5.16 (2026-09-30)

🐛 Bug Fixes

  • docker: build the image binary for the target platform (8363ff5)

📚 Documentation

👷 CI/CD

  • release: add the scripts that pin the image digest at the tag (9fca2fe)
  • release: build the image before the tag, pin its digest in it (858a132)
  • release: pin v0.5.15 refs [skip ci] (20d607d)

... (truncated)

Changelog

Sourced from getplumber/plumber's changelog.

0.6.0 (2026-10-08)

⚠ BREAKING CHANGES

  • analyze: score letters, --min-score and --min-points gates and badges now read the contextual score. Run with --score-profile v3 or set PLUMBER_ANALYZE_SCORE_PROFILE=v3 to keep the previous formula.

Co-Authored-By: Claude Fable 5.1 [email protected] Claude-Session: https://claude.ai/code/session_01Ft8dmcMLK7V9XZh7JX4vzs

✨ Features

  • analyze: the contextual score is the default, on every output, with the labelled corpus and the migration report (41eff60)
  • situation: job facts for attack paths, entry subjects, push trigger filters and cache inheritance (89f30e4)

0.5.24 (2026-10-08)

✨ Features

  • config: exempt dependabot actions from the pin-by-SHA default (834d9c4)

📚 Documentation

  • readme: add Outscale and Telstra to the adopters row (428a960)

✅ Tests

  • control: pin the shipped pin-by-SHA trust boundary to GitHub-owned orgs (ec5c1ef), closes #531

0.5.23 (2026-10-07)

✨ Features

  • config: trust jfrog-fastci actions in the default allowlist (4b55d04)

0.5.22 (2026-10-07)

✨ Features

  • config: trust CodSpeedHQ actions in the default allowlist (27f0d74)

0.5.21 (2026-10-07)

✨ Features

... (truncated)

Commits
  • 6444205 chore(release): 0.5.18 [skip ci]
  • 6f3c660 feat(gitlab): copy the project visibility onto the pipeline
  • 0f8e228 feat(github): collect the repository visibility into the pipeline
  • b40dcc5 feat(gitlab): jobs carry needs, caches, artifacts and environment
  • 7d98eff feat(github): jobs carry runs-on, needs, caches and artifacts
  • 9bd2d5a feat(ir): visibility, runs-on, needs, caches and artifacts on the pipeline model
  • 40125a7 docs(readme): use the official Resty logo in the adopters row
  • a874992 chore(release): 0.5.17 [skip ci]
  • c991a47 docs: show the positional target in the remote-scan examples
  • 14f3908 feat(analyze): accept the repository to scan as a positional target
  • Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.38.1 to 4.38.2

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.38.2

  • Update default CodeQL bundle version to 2.27.1. #4160
Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.3 - 08 Oct 2026

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

  • Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

... (truncated)

Commits
  • 2892aa5 Merge pull request #4168 from github/update-v4.38.2-a6ef2c96f
  • 8ad03a3 Trigger workflows
  • 98af865 Update changelog for v4.38.2
  • a6ef2c9 Merge pull request #4156 from github/mario-campos/fix-validate-cmd
  • 1ef28a1 Merge pull request #4166 from github/dependabot/github_actions/dot-github/wor...
  • 26cb08b Merge pull request #4163 from github/mbg/fix-getCommitOid-stubs
  • f035ce3 Merge pull request #4165 from github/dependabot/npm_and_yarn/npm-minor-8eaed9...
  • 5e4e255 Rebuild
  • b13f5f4 Bump ruby/setup-ruby
  • c87fe57 Rebuild
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 2, 2026
@dependabot
dependabot Bot requested a review from stephrobert as a code owner October 2, 2026 09:36
@dependabot dependabot Bot changed the title chore(ci): bump the actions-minor-and-patch group with 5 updates chore(ci): bump the actions-minor-and-patch group across 1 directory with 5 updates Oct 2, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-minor-and-patch-6fbde6c6a3 branch from 1c9d149 to 6433116 Compare October 2, 2026 11:58
@dependabot
chore(ci): bump the actions-minor-and-patch group across 1 directory …
d2e8dc3 
…with 5 updates

Bumps the actions-minor-and-patch group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.1.0` | `10.2.0` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.1` | `4.38.2` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.1` | `4.38.2` |
| [getplumber/plumber](https://github.com/getplumber/plumber) | `0.5.2` | `0.5.18` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.1` | `4.38.2` |



Updates `astral-sh/setup-uv` from 10.1.0 to 10.2.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@bec219d...c18668a)

Updates `github/codeql-action/init` from 4.38.1 to 4.38.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@1c5b675...2892aa5)

Updates `github/codeql-action/analyze` from 4.38.1 to 4.38.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@1c5b675...2892aa5)

Updates `getplumber/plumber` from 0.5.2 to 0.5.18
- [Release notes](https://github.com/getplumber/plumber/releases)
- [Changelog](https://github.com/getplumber/plumber/blob/main/CHANGELOG.md)
- [Commits](getplumber/plumber@d37150c...6444205)

Updates `github/codeql-action/upload-sarif` from 4.38.1 to 4.38.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@1c5b675...2892aa5)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor-and-patch
- dependency-name: getplumber/plumber
  dependency-version: 0.5.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-minor-and-patch
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-minor-and-patch
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-minor-and-patch
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-minor-and-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-minor-and-patch-6fbde6c6a3 branch from 6433116 to d2e8dc3 Compare October 9, 2026 12:49
@stephrobert
stephrobert merged commit f7999d7 into main Oct 9, 2026
8 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/actions-minor-and-patch-6fbde6c6a3 branch October 9, 2026 15:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@stephrobert stephrobert Awaiting requested review from stephrobert stephrobert is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@stephrobert