chore(deps): bump the actions-version-updates group across 1 directory with 14 updates by dependabot[bot] · Pull Request #93 · zitadel/client-ruby

dependabot · 2026-07-02T09:06:31Z

Bumps the actions-version-updates group with 14 updates in the / directory:

Package	From	To
step-security/harden-runner	`2.12.0`	`2.19.4`
actions/checkout	`4.2.2`	`7.0.0`
actions/dependency-review-action	`4.7.1`	`5.0.0`
docker/setup-buildx-action	`3.10.0`	`4.1.0`
docker/build-push-action	`6.17.0`	`7.3.0`
ruby/setup-ruby	`1.288.0`	`1.315.0`
stefanzweifel/git-auto-commit-action	`5.2.0`	`7.2.0`
actions/download-artifact	`4.3.0`	`8.0.1`
JetBrains/qodana-action	`201551778d1453e36c5c0aa26f89a94775cb1acc`	`f5aa2889b113c16bd6aee47817b027537ee33ac7`
ossf/scorecard-action	`2.4.1`	`2.4.3`
github/codeql-action/upload-sarif	`3.28.18`	`4.36.2`
mridang/action-test-reporter	`1.2.5`	`1.7.0`
actions/upload-artifact	`4.6.2`	`7.0.1`
dorny/test-reporter	`2.0.0`	`3.0.0`

Updates step-security/harden-runner from 2.12.0 to 2.19.4

Release notes

Sourced from step-security/harden-runner's releases.

v2.19.4

What's Changed

Improvements for HTTPS Monitoring for the Enterprise tier of Harden Runner

Full Changelog: step-security/harden-runner@v2.19.3...v2.19.4

v2.19.3

What's Changed

Default to audit mode when api-key missing with use-policy-store by @varunsh-coder in step-security/harden-runner#665

Full Changelog: step-security/harden-runner@v2.19.2...v2.19.3

v2.19.2

What's Changed

Update the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.

Full Changelog: step-security/harden-runner@v2.19.1...v2.19.2

v2.19.1

What's Changed

fix: detect ubuntu-slim runners early and bail out by @devantler in step-security/harden-runner#657

What the fix changes

Harden-Runner will detect ubuntu-slim runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.

What the fix does not do

Jobs running on ubuntu-slim will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).

Per GitHub's docs on single-CPU runners: "The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported." Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.

For StepSecurity enterprise customers If your security posture requires that workflows are always monitored, you can block the use of ubuntu-slim via workflow run policies see the Runner Label Policy docs. This lets you enforce that jobs only run on monitored runner types.

New Contributors

@devantler made their first contribution in step-security/harden-runner#657

Full Changelog: step-security/harden-runner@v2.19.0...v2.19.1

v2.19.0

What's Changed

New Runner Support

Harden-Runner now supports Depot, Blacksmith, Namespace, and WarpBuild runners with the same egress monitoring, runtime monitoring, and policy enforcement available on GitHub-hosted runners.

Automated Incident Response for Supply Chain Attacks

Global block list: Outbound connections to known malicious domains and IPs are now blocked even in audit mode.

System-defined detection rules: Harden-Runner will trigger lockdown mode when a high risk event is detected during an active supply chain attack (for example, a process reading the memory of the runner worker process, a common technique for stealing GitHub Actions secrets).

Bug Fixes

Windows and macOS: stability and reliability fixes

... (truncated)

Commits

9af89fc Merge pull request #667 from step-security/update-agent-v1.8.6
485dce8 Update agent to v1.8.6
ab7a940 Merge pull request #665 from step-security/fix/use-policy-store-default-audit
ec41b78 Default to audit mode when api-key missing with use-policy-store
9ca718d Merge pull request #664 from step-security/update-agent-v1.8.5
1dee3df Update agent to v1.8.5
a5ad31d Merge pull request #657 from devantler/fix/ubuntu-slim-user-env
6e92856 build dist and trim ubuntu-slim message
4e0504e Merge branch 'main' into fix/ubuntu-slim-user-env
8d3c67d Release v2.19.0 (#661)
Additional commits viewable in compare view

Updates actions/checkout from 4.2.2 to 7.0.0

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464

update error wording by @aiqiaoy in actions/checkout#2467

New Contributors

@aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

Update changelog by @ericsciple in actions/checkout#2357

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

Update changelog for v6.0.3 by @yaananth in actions/checkout#2446

New Contributors

@yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @TingluoHuang in actions/checkout#2355

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Update all references from v5 and v4 to v6 by @ericsciple in actions/checkout#2314

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

Clarify v6 README by @ericsciple in actions/checkout#2328

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

Persist creds to a separate file by @ericsciple in actions/checkout#2286

v6-beta by @ericsciple in actions/checkout#2298

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.0

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

... (truncated)

Commits

9c091bb update error wording (#2467)
1044a6d getting ready for checkout v7 release (#2464)
f028218 Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)
d914b26 upgrade module to esm and update dependencies (#2463)
537c7ef Bump @actions/core and @actions/tool-cache and Remove uuid (#2459)
130a169 Bump js-yaml from 4.1.0 to 4.2.0 (#2461)
7d09575 Bump flatted from 3.3.1 to 3.4.2 (#2460)
0f9f3aa Bump actions/publish-immutable-action (#2458)
f9e715a block checking out fork pr for pull_request_target and workflow_run (#2454)
df4cb1c Update changelog for v6.0.3 (#2446)
Additional commits viewable in compare view

Updates actions/dependency-review-action from 4.7.1 to 5.0.0

Release notes

Sourced from actions/dependency-review-action's releases.

5.0.0

This is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version v2.327.1 to run.

What's Changed

Add .github/copilot-instructions.md for Copilot coding agent by @ahpook in actions/dependency-review-action#1067

Update Node.js runtime from 20 to 24 by @scottschreckengaust in actions/dependency-review-action#1084

Bump spdx-license-ids from 3.0.20 to 3.0.23 by @mongolyy in actions/dependency-review-action#1091

docs: bump actions/checkout from v4 to v6 in workflow examples by @Marukome0743 in actions/dependency-review-action#1077

fix: patched version display for advisories with non-strict semver ranges (e.g. Maven beta versions) by @tspascoal in actions/dependency-review-action#1076

Resolve security findings by @AshelyTC in actions/dependency-review-action#1094

v5.0.0 release branch by @ahpook in actions/dependency-review-action#1098

New Contributors

@scottschreckengaust made their first contribution in actions/dependency-review-action#1084

@mongolyy made their first contribution in actions/dependency-review-action#1091

@Marukome0743 made their first contribution in actions/dependency-review-action#1077

Full Changelog: actions/dependency-review-action@v4.9.0...v5.0.0

Dependency Review Action 4.9.0

This feature release contains a couple of notable changes:

There is a new configuration option show_patched_versions which will add a column to the output, showing the fix version of each vulnerable dependency. Thanks @felickz!

Runs which do not display OpenSSF scorecards no longer fetch scorecard information; previously it was fetched regardless of whether or not it was displayed, causing unneccessary slowness. Great catch @jantiebot!

There are a couple of fixes to purl parsing which should improve match accuracy for allow-package-dependency lists, including case (in)sensitivity and url-encoded namespaces Thanks @juxtin!

What's Changed

Compare normalized purls to account for encoding quirks by @juxtin in actions/dependency-review-action#1056

Make purl comparisons case insensitive by @juxtin in actions/dependency-review-action#1057

Feat: Add Patched Version to Vulnerabilities summary by @felickz in actions/dependency-review-action#1045

fix: only get scorecard levels if user wants to see the OpenSSF scorecard by @jantiebot in actions/dependency-review-action#1060

Bump actions/stale from 10.1.0 to 10.2.0 by @dependabot[bot] in actions/dependency-review-action#1058

Bump actions/checkout from 4 to 6 by @dependabot[bot] in actions/dependency-review-action#1021

Updates for release 4.9.0 by @ahpook in actions/dependency-review-action#1064

New Contributors

@jantiebot made their first contribution in actions/dependency-review-action#1060

Full Changelog: actions/dependency-review-action@v4.8.3...v4.9.0

4.8.3

Dependency Review Action v4.8.3

This is a bugfix release that updates a number of upstream dependencies and includes a fix for the earlier feature that detected oversized summaries and upload them as artifacts, which could occasionally crash the action.

We have also updated the release process to use a long-lived v4 branch for the action, instead of a force-pushed tag, which aligns better with git branching strategies; the change should be transparent to end users.

What's Changed

GitHub Actions can't push to our protected main by @dangoor in actions/dependency-review-action#1017

Bump actions/stale from 9.1.0 to 10.1.0 by @dependabot[bot] in actions/dependency-review-action#995

... (truncated)

Commits

a1d282b Merge pull request #1098 from actions/ahpook/v5-release
eb6c199 update examples to show @v5
3943c2c v5.0.0 release branch
454943c Merge pull request #1094 from actions/ashelytc/security-findings
6d92a12 revert @typescript-eslint/parser update
a8e5a7e Merge pull request #1076 from tspascoal/fix-version-matching-for-non-string-s...
b6b7079 update @typescript-eslint/parser to 8.40.0
821a21d update more dependencies
05aaaae run npm audit fix
55d3e75 Merge pull request #1077 from Marukome0743/docs/checkout
Additional commits viewable in compare view

Updates docker/setup-buildx-action from 3.10.0 to 4.1.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.1.0

Bump @docker/actions-toolkit from 0.79.0 to 0.90.0 in docker/setup-buildx-action#489

Bump brace-expansion from 1.1.12 to 5.0.6 in docker/setup-buildx-action#547 docker/setup-buildx-action#508

Bump fast-xml-builder from 1.0.0 to 1.2.0 in docker/setup-buildx-action#540

Bump fast-xml-parser from 5.4.2 to 5.8.0 in docker/setup-buildx-action#496

Bump flatted from 3.3.3 to 3.4.2 in docker/setup-buildx-action#499

Bump glob from 10.3.12 to 13.0.6 in docker/setup-buildx-action#495

Bump handlebars from 4.7.8 to 4.7.9 in docker/setup-buildx-action#504

Bump lodash from 4.17.23 to 4.18.1 in docker/setup-buildx-action#523

Bump picomatch from 4.0.3 to 4.0.4 in docker/setup-buildx-action#503

Bump postcss from 8.5.6 to 8.5.10 in docker/setup-buildx-action#537

Bump tar from 6.2.1 to 7.5.15 in docker/setup-buildx-action#545

Bump undici from 6.23.0 to 6.25.0 in docker/setup-buildx-action#492

Bump vite from 7.3.1 to 7.3.2 in docker/setup-buildx-action#520

Full Changelog: docker/setup-buildx-action@v4.0.0...v4.1.0

v4.0.0

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in docker/setup-buildx-action#483

Remove deprecated inputs/outputs by @crazy-max in docker/setup-buildx-action#464

Switch to ESM and update config/test wiring by @crazy-max in docker/setup-buildx-action#481

Bump @actions/core from 1.11.1 to 3.0.0 in docker/setup-buildx-action#475

Bump @docker/actions-toolkit from 0.63.0 to 0.79.0 in docker/setup-buildx-action#482 docker/setup-buildx-action#485

Bump js-yaml from 4.1.0 to 4.1.1 in docker/setup-buildx-action#452

Bump lodash from 4.17.21 to 4.17.23 in docker/setup-buildx-action#472

Bump minimatch from 3.1.2 to 3.1.5 in docker/setup-buildx-action#480

Full Changelog: docker/setup-buildx-action@v3.12.0...v4.0.0

v3.12.0

Deprecate install input by @crazy-max in docker/setup-buildx-action#455

Bump @docker/actions-toolkit from 0.62.1 to 0.63.0 in docker/setup-buildx-action#434

Bump brace-expansion from 1.1.11 to 1.1.12 in docker/setup-buildx-action#436

Bump form-data from 2.5.1 to 2.5.5 in docker/setup-buildx-action#432

Bump undici from 5.28.4 to 5.29.0 in docker/setup-buildx-action#435

Full Changelog: docker/setup-buildx-action@v3.11.1...v3.12.0

v3.11.1

Fix keep-state not being respected by @crazy-max in docker/setup-buildx-action#429

Full Changelog: docker/setup-buildx-action@v3.11.0...v3.11.1

v3.11.0

Keep BuildKit state support by @crazy-max in docker/setup-buildx-action#427

Remove aliases created when installing by default by @hashhar in docker/setup-buildx-action#139

Bump @docker/actions-toolkit from 0.56.0 to 0.62.1 in docker/setup-buildx-action#422 docker/setup-buildx-action#425

Full Changelog: docker/setup-buildx-action@v3.10.0...v3.11.0

Commits

d7f5e7f Merge pull request #489 from docker/dependabot/npm_and_yarn/docker/actions-to...
92bc5c9 chore: update generated content
da11e35 build(deps): bump @docker/actions-toolkit from 0.79.0 to 0.90.0
f021e16 Merge pull request #492 from docker/dependabot/npm_and_yarn/undici-6.24.1
b5af94f chore: update generated content
16ad977 build(deps): bump undici from 6.23.0 to 6.25.0
d7a12d7 Merge pull request #495 from docker/dependabot/npm_and_yarn/glob-10.5.0
28ff27d build(deps): bump glob from 10.3.12 to 13.0.6
daf436b Merge pull request #496 from docker/dependabot/npm_and_yarn/fast-xml-parser-5...
9725348 chore: update generated content
Additional commits viewable in compare view

Updates docker/build-push-action from 6.17.0 to 7.3.0

Release notes

Sourced from docker/build-push-action's releases.

v7.3.0

Preserve names in esbuild bundle by @crazy-max in docker/build-push-action#1567

Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/build-push-action#1545 docker/build-push-action#1572

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/build-push-action#1568

Bump js-yaml from 4.1.1 to 4.3.0 in docker/build-push-action#1566

Bump tmp from 0.2.5 to 0.2.7 in docker/build-push-action#1547

Bump undici from 6.24.1 to 6.27.0 in docker/build-push-action#1564

Bump vite from 7.3.2 to 7.3.6 in docker/build-push-action#1563

Full Changelog: docker/build-push-action@v7.2.0...v7.3.0

v7.2.0

Bump @actions/core from 3.0.0 to 3.0.1 in docker/build-push-action#1525

Bump @docker/actions-toolkit from 0.87.0 to 0.90.0 in docker/build-push-action#1517

Bump brace-expansion from 2.0.2 to 5.0.6 in docker/build-push-action#1534

Bump fast-xml-builder from 1.1.4 to 1.2.0 in docker/build-push-action#1529

Bump fast-xml-parser from 5.5.7 to 5.8.0 in docker/build-push-action#1521

Bump postcss from 8.5.6 to 8.5.10 in docker/build-push-action#1526

Bump tar from 6.2.1 to 7.5.15 in docker/build-push-action#1533

Full Changelog: docker/build-push-action@v7.1.0...v7.2.0

v7.1.0

Git context query format support by @crazy-max in docker/build-push-action#1505

Bump @docker/actions-toolkit from 0.79.0 to 0.87.0 by @crazy-max in docker/build-push-action#1505

Bump brace-expansion from 1.1.12 to 1.1.13 in docker/build-push-action#1500

Bump fast-xml-parser from 5.4.2 to 5.5.7 in docker/build-push-action#1489

Bump flatted from 3.3.3 to 3.4.2 in docker/build-push-action#1491

Bump glob from 10.3.12 to 10.5.0 in docker/build-push-action#1490

Bump handlebars from 4.7.8 to 4.7.9 in docker/build-push-action#1497

Bump lodash from 4.17.23 to 4.18.1 in docker/build-push-action#1510

Bump picomatch from 4.0.3 to 4.0.4 in docker/build-push-action#1496

Bump undici from 6.23.0 to 6.24.1 in docker/build-push-action#1486

Bump vite from 7.3.1 to 7.3.2 in docker/build-push-action#1509

Full Changelog: docker/build-push-action@v7.0.0...v7.1.0

v7.0.0

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in docker/build-push-action#1470

Remove deprecated DOCKER_BUILD_NO_SUMMARY and DOCKER_BUILD_EXPORT_RETENTION_DAYS envs by @crazy-max in docker/build-push-action#1473

Remove legacy export-build tool support for build summary by @crazy-max in docker/build-push-action#1474

Switch to ESM and update config/test wiring by @crazy-max in docker/build-push-action#1466

Bump @actions/core from 1.11.1 to 3.0.0 in docker/build-push-action#1454

Bump @docker/actions-toolkit from 0.62.1 to 0.79.0 in docker/build-push-action#1453 docker/build-push-action#1472 docker/build-push-action#1479

Bump minimatch from 3.1.2 to 3.1.5 in docker/build-push-action#1463

Full Changelog: docker/build-push-action@v6.19.2...v7.0.0

v6.19.2

Preserve port in GIT_AUTH_TOKEN host by @crazy-max in docker/build-push-action#1458

... (truncated)

Commits

53b7df9 Merge pull request #1572 from docker/dependabot/npm_and_yarn/docker/actions-t...
154298c [dependabot skip] chore: update generated content
cb1238b chore(deps): Bump @docker/actions-toolkit from 0.91.0 to 0.92.0
24f845d Merge pull request #1566 from docker/dependabot/npm_and_yarn/js-yaml-4.2.0
9c69730 [dependabot skip] chore: update generated content
bc3a3a5 Merge pull request #1574 from docker/dependabot/github_actions/aws-actions/co...
a82c504 chore(deps): Bump js-yaml from 4.1.1 to 4.3.0
0285a75 Merge pull request #1573 from docker/dependabot/github_actions/actions/cache-...
c6ad2a3 Merge pull request #1575 from docker/dependabot/github_actions/actions/checko...
d37484f Merge pull request #1564 from docker/dependabot/npm_and_yarn/undici-6.27.0
Additional commits viewable in compare view

Updates ruby/setup-ruby from 1.288.0 to 1.315.0

Release notes

Sourced from ruby/setup-ruby's releases.

v1.315.0

What's Changed

Bump actions/checkout from 6 to 7 by @dependabot[bot] in ruby/setup-ruby#924

Add ruby-3.4.10 by @ruby-builder-bot in ruby/setup-ruby#925

Full Changelog: ruby/setup-ruby@v1.314.0...v1.315.0

v1.314.0

What's Changed

Add support for ubuntu-26.04 and ubuntu-26.04-arm by @eregon in ruby/setup-ruby#923

Full Changelog: ruby/setup-ruby@v1.313.0...v1.314.0

v1.313.0

What's Changed

Add jruby-10.0.6.0 by @ruby-builder-bot in ruby/setup-ruby#921

Full Changelog: ruby/setup-ruby@v1.312.0...v1.313.0

v1.312.0

What's Changed

Use BUNDLE_LOCKFILE when detecting the lockfile by @Thomascountz in ruby/setup-ruby#919

New Contributors

@Thomascountz made their first contribution in ruby/setup-ruby#919

Full Changelog: ruby/setup-ruby@v1.311.0...v1.312.0

v1.311.0

What's Changed

Add jruby-9.4.15.0 by @ruby-builder-bot in ruby/setup-ruby#920

Full Changelog: ruby/setup-ruby@v1.310.0...v1.311.0

v1.310.0

What's Changed

Add ruby-4.0.5 by @ruby-builder-bot in ruby/setup-ruby#918

Full Changelog: ruby/setup-ruby@v1.309.0...v1.310.0

v1.309.0

What's Changed

Update CRuby releases on Windows by @ruby-builder-bot in ruby/setup-ruby#917

... (truncated)

Commits

0dafeac Add ruby-3.4.10
bf35c27 Bump actions/checkout from 6 to 7
9eb537c Add support for ubuntu-26.04 and ubuntu-26.04-arm
e1a3b10 Improve versions-strings-for-builder.rb
0df5288 Remove gem install sassc on Windows JRuby
89f9052 Add jruby-10.0.6.0
12fd324 Use BUNDLE_LOCKFILE when detecting the lockfile
a99ac84 Add jruby-9.4.15.0
afeafc3 Add ruby-4.0.5
28c65f7 Update CRuby releases on Windows
Additional commits viewable in compare view

Updates stefanzweifel/git-auto-commit-action from 5.2.0 to 7.2.0

Release notes

Sourced from stefanzweifel/git-auto-commit-action's releases.

v7.2.0

Added

Add hooks to run shell snippets around git operations (#411) @stefanzweifel

Emit warning for pull_request_target trigger usage (#410) @stefanzweifel

Fixed

docs(action): fix input and output descriptions in action.yml (#406) @kranthipoturaju

docs: fix typos, grammar, and formatting across markdown files (#408) @kranthipoturaju

docs: fix broken and redirecting URLs in README.md (#407) @kranthipoturaju

README: clearify meaning of the repository field (#404) @gucio321

Dependency Updates

Bump actions/checkout from 6 to 7 (#409) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

Bump release-drafter/release-drafter from 6 to 7 (#403) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

v7.1.0

Added

Add skip_push input option (#401) @kvanzuijlen

Changes

docs: fix typo in README.md (#400) @GideonBear

Dependency Updates

Bump actions/checkout from 5 to 6 (#399) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

Bump bats from 1.12.0 to 1.13.0 (#398) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

v7.0.0

Added

Restore skip_fetch, skip_checkout, create_branch (#388) @stefanzweifel

Restore Detached State Detection (#393) @stefanzweifel

Add Support for Tag Messages (#391) @EliasBoulharts

Changed

Run Action on Node 24 (#389) @stefanzweifel

Dependency Updates

Bump actions/checkout from 4 to 5 (#386) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

v6.0.1

Fixed

... (truncat...

Description has been truncated

…y with 14 updates Bumps the actions-version-updates group with 14 updates in the / directory: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.12.0` | `2.19.4` | | [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `7.0.0` | | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.7.1` | `5.0.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.10.0` | `4.1.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6.17.0` | `7.3.0` | | [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `1.288.0` | `1.315.0` | | [stefanzweifel/git-auto-commit-action](https://github.com/stefanzweifel/git-auto-commit-action) | `5.2.0` | `7.2.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.1` | | [JetBrains/qodana-action](https://github.com/jetbrains/qodana-action) | `201551778d1453e36c5c0aa26f89a94775cb1acc` | `f5aa2889b113c16bd6aee47817b027537ee33ac7` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.1` | `2.4.3` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `3.28.18` | `4.36.2` | | [mridang/action-test-reporter](https://github.com/mridang/action-test-reporter) | `1.2.5` | `1.7.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.1` | | [dorny/test-reporter](https://github.com/dorny/test-reporter) | `2.0.0` | `3.0.0` | Updates `step-security/harden-runner` from 2.12.0 to 2.19.4 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@0634a26...9af89fc) Updates `actions/checkout` from 4.2.2 to 7.0.0 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@11bd719...9c091bb) Updates `actions/dependency-review-action` from 4.7.1 to 5.0.0 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](actions/dependency-review-action@da24556...a1d282b) Updates `docker/setup-buildx-action` from 3.10.0 to 4.1.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@b5ca514...d7f5e7f) Updates `docker/build-push-action` from 6.17.0 to 7.3.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@1dc7386...53b7df9) Updates `ruby/setup-ruby` from 1.288.0 to 1.315.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@09a7688...0dafeac) Updates `stefanzweifel/git-auto-commit-action` from 5.2.0 to 7.2.0 - [Release notes](https://github.com/stefanzweifel/git-auto-commit-action/releases) - [Changelog](https://github.com/stefanzweifel/git-auto-commit-action/blob/master/CHANGELOG.md) - [Commits](stefanzweifel/git-auto-commit-action@b863ae1...4a55954) Updates `actions/download-artifact` from 4.3.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@d3f86a1...3e5f45b) Updates `JetBrains/qodana-action` from 201551778d1453e36c5c0aa26f89a94775cb1acc to f5aa2889b113c16bd6aee47817b027537ee33ac7 - [Release notes](https://github.com/jetbrains/qodana-action/releases) - [Commits](JetBrains/qodana-action@2015517...f5aa288) Updates `ossf/scorecard-action` from 2.4.1 to 2.4.3 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@f49aabe...4eaacf0) Updates `github/codeql-action/upload-sarif` from 3.28.18 to 4.36.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@ff0a06e...8aad20d) Updates `mridang/action-test-reporter` from 1.2.5 to 1.7.0 - [Release notes](https://github.com/mridang/action-test-reporter/releases) - [Changelog](https://github.com/mridang/action-test-reporter/blob/master/release.config.mjs) - [Commits](mridang/action-test-reporter@v1.2.5...v1.7.0) Updates `actions/upload-artifact` from 4.6.2 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@ea165f8...043fb46) Updates `dorny/test-reporter` from 2.0.0 to 3.0.0 - [Release notes](https://github.com/dorny/test-reporter/releases) - [Changelog](https://github.com/dorny/test-reporter/blob/main/CHANGELOG.md) - [Commits](dorny/test-reporter@6e6a65b...a43b3a5) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.19.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-version-updates - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: actions/dependency-review-action dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: docker/setup-buildx-action dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: docker/build-push-action dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: ruby/setup-ruby dependency-version: 1.315.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-version-updates - dependency-name: stefanzweifel/git-auto-commit-action dependency-version: 7.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: JetBrains/qodana-action dependency-version: f5aa2889b113c16bd6aee47817b027537ee33ac7 dependency-type: direct:production dependency-group: actions-version-updates - dependency-name: ossf/scorecard-action dependency-version: 2.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-version-updates - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: mridang/action-test-reporter dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-version-updates - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: dorny/test-reporter dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-07-02T09:12:09Z

Qodana for PHP

It seems all right 👌

No new problems were found according to the checks applied

💡 Qodana analysis was run in the pull request mode: only the changed files were checked
☁️ View the detailed Qodana report

Contact Qodana team

Contact us at qodana-support@jetbrains.com

Or via our issue tracker: https://jb.gg/qodana-issue
Or share your feedback: https://jb.gg/qodana-discussions

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions workflows labels Jul 2, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the actions-version-updates group across 1 directory with 14 updates#93

chore(deps): bump the actions-version-updates group across 1 directory with 14 updates#93
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-version-updates-66237abebc

dependabot Bot commented on behalf of github Jul 2, 2026

Uh oh!

github-actions Bot commented Jul 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 2, 2026

v2.19.4

What's Changed

v2.19.3

What's Changed

v2.19.2

What's Changed

v2.19.1

What's Changed

New Contributors

v2.19.0

What's Changed

New Runner Support

Automated Incident Response for Supply Chain Attacks

Bug Fixes

v7.0.0

What's Changed

New Contributors

v6.0.3

What's Changed

New Contributors

v6.0.2

What's Changed

v6.0.1

What's Changed

v6.0.0

What's Changed

Changelog

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

5.0.0

What's Changed

New Contributors

Dependency Review Action 4.9.0

What's Changed

New Contributors

4.8.3

Dependency Review Action v4.8.3

What's Changed

v4.1.0

v4.0.0

v3.12.0

v3.11.1

v3.11.0

v7.3.0

v7.2.0

v7.1.0

v7.0.0

v6.19.2

v1.315.0

What's Changed

v1.314.0

What's Changed

v1.313.0

What's Changed

v1.312.0

What's Changed

New Contributors

v1.311.0

What's Changed

v1.310.0

What's Changed

v1.309.0

What's Changed

v7.2.0

Added

Fixed

Dependency Updates

v7.1.0