Skip to content

build(deps): bump the github-actions group with 8 updates - #1

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-be0f7ee6ab
Open

build(deps): bump the github-actions group with 8 updates#1
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-be0f7ee6ab

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the github-actions group with 8 updates:

Package From To
actions/checkout 4 7
gitleaks/gitleaks-action 2 3
actions/setup-python 5 7
SonarSource/sonarqube-scan-action 5 8
aquasecurity/trivy-action 0.33.1 0.36.0
actions/setup-node 4 7
aws-actions/configure-aws-credentials 4 5
aquasecurity/setup-trivy 0.2.3 0.3.1

Updates actions/checkout from 4 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates gitleaks/gitleaks-action from 2 to 3

Release notes

Sourced from gitleaks/gitleaks-action's releases.

v3.0.0

What's changed

gitleaks-action v3 migrates the runtime from Node 20 to Node 24. No changes to inputs, outputs, or behavior. Update your workflow from gitleaks/gitleaks-action@v2 to gitleaks/gitleaks-action@v3.

Migration

# Before
- uses: gitleaks/gitleaks-action@v2
After

uses: gitleaks/gitleaks-action@v3

Why

GitHub is deprecating the Node 20 runtime for Actions:

  • June 2, 2026: GitHub flips the runner default to Node 24. Workflows using gitleaks-action@v2 (Node 20) will still run, but only if ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true is set as an environment variable.
  • September 16, 2026: Node 20 is removed from GitHub-hosted runners entirely. gitleaks-action@v2 stops working regardless of any opt-out flag.

Changes

  • action.yml: runtime node20 → node24
  • @actions/core: 1.10.0 → 1.11.1
  • dist/ rebuilt
  • Example workflows updated to actions/checkout@v6 and gitleaks-action@v3
  • README updated with v3 migration guide

Self-hosted runners

If you use self-hosted runners, ensure your runner version is >= v2.327.1 (required for Node 24 support).

v2.3.9

What's Changed

Full Changelog: gitleaks/gitleaks-action@v2.3.8...v2.3.9

v2.3.8

What's Changed

New Contributors

Full Changelog: gitleaks/gitleaks-action@v2.3.7...v2.3.8

... (truncated)

Commits

Updates actions/setup-python from 5 to 7

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

v6.3.0

What's Changed

Enhancement

Dependency update

Documentation

New Contributors

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

v6.2.0

What's Changed

Dependency Upgrades

... (truncated)

Commits

Updates SonarSource/sonarqube-scan-action from 5 to 8

Release notes

Sourced from SonarSource/sonarqube-scan-action's releases.

v8.0.0

What's Changed

Breaking change

Full Changelog: SonarSource/sonarqube-scan-action@v7...v8.0.0

v7.2.1

What's Changed

Full Changelog: SonarSource/sonarqube-scan-action@v7...v7.2.1

v7.2.0

What's Changed

Full Changelog: SonarSource/sonarqube-scan-action@v7...v7.2.0

v7.1.0

What's Changed

Full Changelog: SonarSource/sonarqube-scan-action@v7...v7.1.0

v7.0.0

What's Changed

New Contributors

Full Changelog: SonarSource/sonarqube-scan-action@v6.0.0...v7.0.0

... (truncated)

Commits
  • 2291811 SQSCANGHA-156 GPG signature verification fails when temporary directory path ...
  • 7cdc154 SQSCANGHA-153 NO-JIRA Bump actions/checkout from 6.0.2 to 7.0.0 (#255)
  • 45f2736 SQSCANGHA-151 Change Code Owners (#254)
  • 7138816 SQSCANGHA-127 Rename downloaded file to .zip before extraction on Windows (#251)
  • 3581139 SQSCANGHA-135 Fix scanner binaries always re-downloaded due to incompatible 4...
  • c9d327c SQSCANGHA-84 Remove outdated wget/curl references
  • b243e51 SQSCANGHA-88 Deprecate the SONARCLOUD_URL env variable support
  • 375c3f5 SQSCANGHA-149 Add scannerBinariesAuthHeader input for authenticated binary do...
  • 9c78323 SQSCANGHA-144 Add gate jobs to QA workflows for branch protection
  • 7006c44 Update SonarScanner CLI to 8.1.0.6389
  • Additional commits viewable in compare view

Updates aquasecurity/trivy-action from 0.33.1 to 0.36.0

Release notes

Sourced from aquasecurity/trivy-action's releases.

v0.36.0

What's Changed

New Contributors

Full Changelog: aquasecurity/trivy-action@v0.35.0...v0.36.0

Release: 0.35.0

What's Changed

Full Changelog: aquasecurity/trivy-action@0.34.2...0.35.0

Release: v0.35.0

This release is a duplicate of 0.35.0 which was not compromised.

As part of our response to the recent supply chain attack, we have migrated all tags to use the v prefix (e.g., v0.35.0 instead of 0.35.0). Going forward, all new releases will use the v prefix convention.

We have intentionally kept the 0.35.0 tag intact to avoid breaking existing workflows that depend on it.

If you are currently using 0.35.0, your workflows are safe — no action is required.

Release: v0.34.0

Full Changelog: aquasecurity/trivy-action@v0.33.1...v0.34.0

Commits

Updates actions/setup-node from 4 to 7

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

... (truncated)

Commits
  • 8207627 Migrate to ESM and upgrade dependencies (#1574)
  • 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
  • 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
  • 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
  • 30eb73b Resolve high-severity audit issues
  • 4e1a87a Update dist
  • 360237f Strict equality
  • 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
  • f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
  • 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
  • Additional commits viewable in compare view

Updates aws-actions/configure-aws-credentials from 4 to 5

Release notes

Sourced from aws-actions/configure-aws-credentials's releases.

v5.0.0

5.0.0 (2025-09-03)

⚠ BREAKING CHANGES

  • Cleanup input handling. Changes invalid boolean input behavior (see #1445)

Features

v4.3.1

4.3.1 (2025-08-04)

Bug Fixes

v4.3.0

4.3.0 (2025-08-04)

NOTE: This release tag originally pointed to 59b441846ad109fa4a1549b73ef4e149c4bfb53b, but a critical bug was discovered shortly after publishing. We updated this tag to d0834ad3a60a024346910e522a81b0002bd37fea to prevent anyone using the 4.3.0 tag from encountering the bug, and we published 4.3.1 to allow workflows to auto update correctly.

Features

Bug Fixes

  • docs: readme samples versioning (5b3c895)
  • the wrong example region for China partition in README (37fe9a7)
  • properly set proxy environment variable (cbea708)

Miscellaneous Chores

v4.2.1

4.2.1 (2025-05-14)

Bug Fixes

... (truncated)

Changelog

Sourced from aws-actions/configure-aws-credentials's changelog.

6.1.1 (2026-05-05)

Miscellaneous Chores

  • various dependency updates

6.1.0 (2026-04-06)

Features

Commits
  • 61815dc chore(main): release 5.1.1 (#1564)
  • 56d6a58 chore: release 5.1.1
  • 4a54c24 chore(deps-dev): bump glob from 10.4.5 to 10.5.0 (#1563)
  • b2793c9 chore(deps-dev): bump @​types/node from 24.10.0 to 24.10.1 (#1559)
  • 8c230bf chore: Update dist
  • f7a5b07 chore(deps): bump @​aws-sdk/client-sts from 3.928.0 to 3.933.0 (#1558)
  • 730fc04 chore(deps-dev): bump @​biomejs/biome from 2.3.4 to 2.3.6 (#1555)
  • bc0dd36 chore(deps-dev): bump memfs from 4.50.0 to 4.51.0 (#1556)
  • f2964c7 chore: Update dist
  • cf46495 chore(deps): bump @​aws-sdk/client-sts from 3.922.0 to 3.928.0 (#1548)
  • Additional commits viewable in compare view

Updates aquasecurity/setup-trivy from 0.2.3 to 0.3.1

Release notes

Sourced from aquasecurity/setup-trivy's releases.

v0.3.1

v0.3.1

🐛 Bug fix

Fixes a regression in v0.3.0 that made the action fail to load in every workflow, even when path was not set:

Unrecognized named-value: 'runner'. Located at position 1 within expression: runner.temp

A literal ${{ runner.temp }} had been left in an input description inside action.yaml. GitHub evaluates every ${{ }} expression in the file — including input descriptions, where the runner context is unavailable — so the action could not be loaded at all. The expression has been removed from the description and from the validation error message. See #37 (#38).

If you are on v0.3.0, upgrade to v0.3.1.

✅ Tests

Added a CI workflow that runs the action on ubuntu / windows / macOS (default, cached, and custom-path installs) and verifies that an invalid path is rejected. Because it exercises the action via uses: ./, it catches action-loading failures like #37 that static linters miss.

ℹ️ Note

The v0.3.0 security hardening and the path breaking change still apply: path must be a literal path; shell variables ($HOME, $RUNNER_TEMP) and ~ are not expanded. Use a GitHub expression or a relative path:

path: ${{ runner.temp }}/trivy
path: ./bins

Full Changelog: aquasecurity/setup-trivy@v0.3.0...v0.3.1

v0.3.0

v0.3.0

[!CAUTION] This release is broken — do not use it. Upgrade to v0.3.1.

v0.3.0 fails to load in every workflow, even when path is not set, with:

Unrecognized named-value: 'runner'. Located at position 1 within expression: runner.temp

The cause is a literal ${{ runner.temp }} left in an input description inside action.yaml. GitHub evaluates every ${{ }} in the file, including in input descriptions where the runner context is unavailable, so the action cannot be loaded at all. Fixed in #38 (released as v0.3.1); see #37.

🔒 Security

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the github-actions group with 8 updates
b060ed0 
Bumps the github-actions group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `7` |
| [gitleaks/gitleaks-action](https://github.com/gitleaks/gitleaks-action) | `2` | `3` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5` | `7` |
| [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action) | `5` | `8` |
| [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) | `0.33.1` | `0.36.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | `4` | `7` |
| [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `4` | `5` |
| [aquasecurity/setup-trivy](https://github.com/aquasecurity/setup-trivy) | `0.2.3` | `0.3.1` |


Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v7)

Updates `gitleaks/gitleaks-action` from 2 to 3
- [Release notes](https://github.com/gitleaks/gitleaks-action/releases)
- [Commits](gitleaks/gitleaks-action@v2...v3)

Updates `actions/setup-python` from 5 to 7
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v5...v7)

Updates `SonarSource/sonarqube-scan-action` from 5 to 8
- [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases)
- [Commits](SonarSource/sonarqube-scan-action@v5...v8)

Updates `aquasecurity/trivy-action` from 0.33.1 to 0.36.0
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](aquasecurity/trivy-action@0.33.1...v0.36.0)

Updates `actions/setup-node` from 4 to 7
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v7)

Updates `aws-actions/configure-aws-credentials` from 4 to 5
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](aws-actions/configure-aws-credentials@v4...v5)

Updates `aquasecurity/setup-trivy` from 0.2.3 to 0.3.1
- [Release notes](https://github.com/aquasecurity/setup-trivy/releases)
- [Commits](aquasecurity/setup-trivy@v0.2.3...v0.3.1)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: gitleaks/gitleaks-action
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: SonarSource/sonarqube-scan-action
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: aquasecurity/trivy-action
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: aquasecurity/setup-trivy
  dependency-version: 0.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants