chore(deps): bump the actions group across 1 directory with 5 updates

[dependabot]

Bumps the actions group with 5 updates in the / directory:

Package	From	To
github/codeql-action/init	4.36.3	4.37.0
github/codeql-action/analyze	4.36.3	4.37.0
github/codeql-action/upload-sarif	4.36.3	4.37.0
aws-actions/configure-aws-credentials	6.2.1	6.2.2
zizmorcore/zizmor-action	0.5.7	0.6.0

Updates github/codeql-action/init from 4.36.3 to 4.37.0

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.0

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

... (truncated)

Commits

• 99df26d Merge pull request #3996 from github/update-v4.37.0-c7c896d71
• 31c2707 Add changenote for #3973
• 72df218 Update changelog for v4.37.0
• c7c896d Merge pull request #3995 from github/update-bundle/codeql-bundle-v2.26.0
• 3f34ff0 Add changelog note
• 43bec09 Update default bundle to codeql-bundle-v2.26.0
• f58f0d1 Merge pull request #3973 from github/mbg/repo-props/config-file-shorthands
• 7dc37cb Merge remote-tracking branch 'origin/main' into mbg/repo-props/config-file-sh...
• 8e22350 Thread ActionState to initConfig
• 69c9e8c Mark some status-report imports as type-only to avoid circular dependencies
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.36.3 to 4.37.0

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.0

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

... (truncated)

Commits

• 99df26d Merge pull request #3996 from github/update-v4.37.0-c7c896d71
• 31c2707 Add changenote for #3973
• 72df218 Update changelog for v4.37.0
• c7c896d Merge pull request #3995 from github/update-bundle/codeql-bundle-v2.26.0
• 3f34ff0 Add changelog note
• 43bec09 Update default bundle to codeql-bundle-v2.26.0
• f58f0d1 Merge pull request #3973 from github/mbg/repo-props/config-file-shorthands
• 7dc37cb Merge remote-tracking branch 'origin/main' into mbg/repo-props/config-file-sh...
• 8e22350 Thread ActionState to initConfig
• 69c9e8c Mark some status-report imports as type-only to avoid circular dependencies
• Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.36.3 to 4.37.0

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.37.0

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

... (truncated)

Commits

• 99df26d Merge pull request #3996 from github/update-v4.37.0-c7c896d71
• 31c2707 Add changenote for #3973
• 72df218 Update changelog for v4.37.0
• c7c896d Merge pull request #3995 from github/update-bundle/codeql-bundle-v2.26.0
• 3f34ff0 Add changelog note
• 43bec09 Update default bundle to codeql-bundle-v2.26.0
• f58f0d1 Merge pull request #3973 from github/mbg/repo-props/config-file-shorthands
• 7dc37cb Merge remote-tracking branch 'origin/main' into mbg/repo-props/config-file-sh...
• 8e22350 Thread ActionState to initConfig
• 69c9e8c Mark some status-report imports as type-only to avoid circular dependencies
• Additional commits viewable in compare view

Updates aws-actions/configure-aws-credentials from 6.2.1 to 6.2.2

Release notes

Sourced from aws-actions/configure-aws-credentials's releases.

v6.2.2

6.2.2 (2026-07-07)

Miscellaneous Chores

• release 6.2.2 (d01d678)

Changelog

Sourced from aws-actions/configure-aws-credentials's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

6.2.2 (2026-07-07)

Miscellaneous Chores

• release 6.2.2 (d01d678)

6.2.1 (2026-06-26)

Bug Fixes

• enforce allowed-account-ids on all auth paths (#1847) (4d281fb)

6.2.0 (2026-06-01)

Features

• add additional session tags by default (#1775) (e0ba768)
• add more retry logic and better logging (#1764) (540d0c1)
• add regex validation to role-session-name (#1765) (e354499)
• Allow custom session tags to be passed when assuming a role (#1759) (61f50f6)
• expose run id in STS client user-agent (#1774) (29d1be3)
• support custom STS endpoints (#1762) (8d52d05)

Bug Fixes

• skip credential check on output-env-credentials: false (#1778) (58e7c47)
• assumeRole failing from session tag size too large (#1808) (d6f5dc3)

6.1.3 (2026-05-28)

Bug Fixes

• fix: allow kubelet token symlink in #1805

6.1.2 (2026-05-26)

Bug Fixes

• additional filesystem checks (#1799) (c39f282)

6.1.1 (2026-05-05)

Miscellaneous Chores

... (truncated)

Commits

• 517a711 chore(main): release 6.2.2 (#1876)
• d01d678 chore: release 6.2.2
• 8efa52b chore(deps-dev): bump vitest dependencies (#1874)
• 8e1eed5 chore(deps-dev): bump @​smithy/property-provider from 4.4.4 to 4.4.6 (#1869)
• 112421a chore(deps-dev): bump @​biomejs/biome from 2.5.1 to 2.5.2 (#1868)
• fbc01c6 chore(deps-dev): bump @​types/node from 26.0.1 to 26.1.0 (#1871)
• b12ca87 chore(deps-dev): bump memfs from 4.57.8 to 4.58.0 (#1873)
• d314f7f chore: Update dist
• a53b65b chore(deps): bump @​aws-sdk/client-sts from 3.1076.0 to 3.1080.0 (#1867)
• 338d2c1 chore(deps-dev): bump sigstore from 4.1.0 to 4.1.1 (#1864)
• Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.5.7 to 0.6.0

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.6.0

zizmor 1.27.0 is now the default version used by the action.

What's Changed

• Fold Docker image pull output into a collapsed Actions log group by @​woodruffw with @​Copilot in zizmorcore/zizmor-action#132
• Readme: document missing inputs by @​staabm in zizmorcore/zizmor-action#130
• ci: block version sync workflow on forks by @​shaanmajid in zizmorcore/zizmor-action#129
• Sync zizmor versions by @​github-actions[bot] in zizmorcore/zizmor-action#137
• Add collect input by @​woodruffw in zizmorcore/zizmor-action#139

New Contributors

• @​woodruffw with @​Copilot made their first contribution in zizmorcore/zizmor-action#132
• @​staabm made their first contribution in zizmorcore/zizmor-action#130
• @​shaanmajid made their first contribution in zizmorcore/zizmor-action#129

Full Changelog: zizmorcore/zizmor-action@v0.5.7...v0.6.0

Commits

• 6599ee8 Add collect input (#139)
• bec05c8 Sync zizmor versions (#137)
• cf59549 Add issue templates (#135)
• f72bf17 chore(deps): bump github/codeql-action/upload-sarif (#134)
• b2a6fac ci: block version sync workflow on forks (#129)
• 2d88f44 Readme: document missing inputs (#130)
• d81e276 Fold Docker image pull output into a collapsed Actions log group (#132)
• 8c13c53 chore(deps): bump the github-actions group with 2 updates (#133)
• 2f8e9c6 README: bump versions (#128)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

module.existing["flipperzero-mcp"].github_repository.this: Refreshing state... [id=flipperzero-mcp]
module.existing["gandi-mcp"].github_repository.this: Refreshing state... [id=gandi-mcp]
module.org_baseline.github_organization_settings.this: Refreshing state... [id=283017149]
module.org_profile_repo.github_repository.this: Refreshing state... [id=.github]
module.management_repo.github_repository.this: Refreshing state... [id=millsymills-com-org]
module.existing["unraid-mcp"].github_repository.this: Refreshing state... [id=unraid-mcp]
module.existing["shortcut-mcp"].github_repository.this: Refreshing state... [id=shortcut-mcp]
module.ruleset_default_branch.github_organization_ruleset.default_branch: Refreshing state... [id=16259943]
module.existing["protonmail-mcp"].github_repository.this: Refreshing state... [id=protonmail-mcp]
module.ruleset_tag_protection.github_organization_ruleset.tag_protection: Refreshing state... [id=16260826]
module.existing["unifi-mcp"].github_repository.this: Refreshing state... [id=unifi-mcp]
module.org_profile_repo.github_repository_vulnerability_alerts.this: Refreshing state... [id=1259819149]
module.management_repo.github_repository_vulnerability_alerts.this: Refreshing state... [id=1234310882]
github_repository_environment.tofu_drift: Refreshing state... [id=millsymills-com-org:tofu-drift]
github_repository_environment.tofu_apply: Refreshing state... [id=millsymills-com-org:tofu-apply]
github_repository_environment.tofu_plan: Refreshing state... [id=millsymills-com-org:tofu-plan]
github_repository_ruleset.management_repo_checks: Refreshing state... [id=16278826]
module.existing["gandi-mcp"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1215582042]
module.existing["shortcut-mcp"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1247298585]
module.existing["unifi-mcp"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1212016554]
module.existing["unraid-mcp"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1212016738]
module.existing["protonmail-mcp"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1221429298]
module.existing["flipperzero-mcp"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1253783165]
github_repository_environment_deployment_policy.tofu_apply_main: Refreshing state... [id=millsymills-com-org:tofu-apply:49164604]
github_repository_environment_deployment_policy.tofu_drift_main: Refreshing state... [id=millsymills-com-org:tofu-drift:49164603]

No changes. Your infrastructure matches the configuration.

OpenTofu has compared your real infrastructure against your configuration and
found no differences, so no changes are needed.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.