chore(deps): Update GitHub Actions by renovate[bot] · Pull Request #175 · arillso/.github

renovate · 2026-09-27T22:37:58Z

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/download-artifact	action	patch	`v8.0.1` → `v8.0.2`
actions/setup-node	action	minor	`v7.0.0` → `v7.1.0`
actions/upload-artifact	action	patch	`v7.0.1` → `v7.0.2`
actions/upload-artifact (changelog)	action	digest	`043fb46` → `cf430e0`
anchore/sbom-action	action	patch	`v0.24.2` → `v0.24.3`
anthropics/claude-code-action	action	patch	`v1.0.233` → `v1.0.251`	`v1.0.253` (+1)
github/codeql-action (changelog)	action	digest	`1c5b675` → `6f2ac81`
github/codeql-action	action	minor	`v4.38.1` → `v4.39.0`
goreleaser/goreleaser-action	action	minor	`v7.2.3` → `v7.3.0`
python	uses-with	minor	`3.14.7` → `3.15.0`
reviewdog/action-shellcheck (changelog)	action	digest	`0a90156` → `d0b8d5f`
trufflesecurity/trufflehog	action	minor	`v3.97.8` → `v3.99.2`

Release Notes

actions/download-artifact

`v8.0.2`

Compare Source

What's Changed

Update the readme by @danwkennedy in #473
Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
Update @actions/artifact to 6.3.1 by @tunc-d in #492
Prepare download-artifact v8.0.2 by @tunc-d in #493

New Contributors

@tunc-d made their first contribution in #492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

actions/setup-node

`v7.1.0`

Compare Source

What's Changed

Enhancements:

Add support for mise.toml file by @gperdomor in #1421
Support absolute paths in node-version-file by @v-mahabaleshwars in #1633

Bug fixes:

Add Node version validation and manifest fetch retry by @v-jitenderpalsingh in #1580

Documentation updates:

README.md: bump actions/checkout to latest version 7 by @deining in #1578
docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by @v-gowridurgad in #1593
Fixed cache recommendation syntax by @SubJunk in #1603

Dependency updates:

Update workflow pins and migrate Node matrices to modern versions by @v-HarithaVattikuti in #1583
Upgrade @actions/cache to 6.2.0 by @philip-gai in #1584
Pin @types/node to v24 by @v-priyagupta108 in #1585
Override brace-expansion to 5.0.8 by @v-priyagupta108 with @Copilot in #1599
Upgrade actions/checkout from 7.0.0 to 7.0.1 by @dependabot in #1598
Upgrade prettier from 3.8.4 to 3.9.6 by @dependabot in #1590
Upgrade @vercel/ncc from 0.44.0 to 0.45.0 by @dependabot in #1610
Upgrade pnpm/action-setup from 6.0.9 to 6.0.10 by @dependabot in #1602
Upgrade baseline-browser-mapping from 2.10.38 to 2.11.22 by @dependabot in #1629
Upgrade @types/semver from 7.7.1 to 7.8.0 by @dependabot in #1616
Upgrade @typescript-eslint/parser from 8.62.0 to 8.70.0 by @dependabot in #1615
Upgrade pnpm/action-setup from 6.0.10 to 6.1.0 by @dependabot in #1631
Upgrade jest-each from 30.4.1 to 30.5.2 by @dependabot in #1636
Upgrade eslint-plugin-n from 18.1.0 to 18.3.0 by @dependabot in #1638
Update dependencies and add license files by @v-HarithaVattikuti in #1642
Upgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by @dependabot in #1635

New Contributors

@v-jitenderpalsingh made their first contribution in #1580
@philip-gai made their first contribution in #1584
@gperdomor made their first contribution in #1421
@SubJunk made their first contribution in #1603

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

actions/upload-artifact

`v7.0.2`

Compare Source

What's Changed

Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
Updates @actions/artifact to v6.3.1.

New Contributors

@tunc-d made their first contribution in #821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

anchore/sbom-action

`v0.24.3`

Compare Source

Added Features

bump type-fest from 5.9.0 to 5.10.0 [PR #742 @dependabot]
bump @types/node from 26.5.1 to 26.6.1 [PR #741 @dependabot]
bump @types/node from 26.4.1 to 26.5.1 [PR #737 @dependabot]
bump typescript-eslint from 8.69.0 to 8.70.0 [PR #736 @dependabot]
bump type-fest from 5.8.0 to 5.9.0 [PR #732 @dependabot]
bump eslint from 10.9.1 to 10.10.0 [PR #733 @dependabot]
bump typescript-eslint from 8.68.0 to 8.69.0 [PR #730 @dependabot]
bump @types/node from 26.2.0 to 26.4.0 [PR #727 @dependabot]
bump typescript-eslint from 8.67.0 to 8.68.0 [PR #726 @dependabot]

Bug Fixes

bump github.com/anchore/go-make from 0.8.0 to 0.8.1 in /.make [PR #738 @dependabot]
bump anchore/go-make/.github/actions/setup from 0.8.0 to 0.8.1 in /.github/actions/bootstrap [PR #740 @dependabot]
bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 [PR #739 @dependabot]
bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 [PR #734 @dependabot]
bump @types/node from 26.4.0 to 26.4.1 [PR #731 @dependabot]
bump tsx from 4.23.12 to 4.23.13 [PR #729 @dependabot]
bump eslint from 10.9.0 to 10.9.1 [PR #728 @dependabot]
bump @humanfs/node from 0.16.7 to 0.16.8 [PR #725 @dependabot]

(Full Changelog)

anthropics/claude-code-action

What's Changed

ci: security hardening for GitHub Actions workflows that call Claude by @qing-ant in #1867

New Contributors

@qing-ant made their first contribution in #1867

Full Changelog: anthropics/claude-code-action@v1.0.237...v1.0.238

`v1.0.237`

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.236...v1.0.237

`v1.0.236`

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.235...v1.0.236

`v1.0.235`

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.234...v1.0.235

`v1.0.234`

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.233...v1.0.234

github/codeql-action

`v4.39.0`

Compare Source

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

`v4.38.3`

Compare Source

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
Update default CodeQL bundle version to 2.27.2. #4203
Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

`v4.38.2`

Compare Source

Update default CodeQL bundle version to 2.27.1. #4160

goreleaser/goreleaser-action

`v7.3.0`

Compare Source

What's Changed

ci(deps): bump the actions group with 3 updates by @dependabot[bot] in #570
chore(deps): bump the npm group with 4 updates by @dependabot[bot] in #571
ci(deps): bump the actions group with 3 updates by @dependabot[bot] in #575
chore(deps): bump the npm group with 2 updates by @dependabot[bot] in #574
chore(deps): bump undici from 6.27.0 to 6.28.0 by @dependabot[bot] in #576
chore(deps): bump js-yaml from 5.2.2 to 5.2.3 by @dependabot[bot] in #573
chore(deps): bump js-yaml from 5.2.3 to 5.4.1 in the npm group by @dependabot[bot] in #578
feat: reuse the goreleaser binary from the runner tool cache by @caarlos0 in #577
ci(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 in the actions group by @dependabot[bot] in #581
chore(deps): bump undici from 6.28.0 to 6.29.0 by @dependabot[bot] in #579
chore(deps): bump the npm group with 2 updates by @dependabot[bot] in #580

Full Changelog: goreleaser/goreleaser-action@v7.2.3...v7.3.0

actions/python-versions (python)

`v3.15.0`: 3.15.0

Compare Source

Python 3.15.0

`v3.14.8`: 3.14.8

Compare Source

Python 3.14.8

trufflesecurity/trufflehog

`v3.99.2`

Compare Source

What's Changed

Copy over dedupe cache size into the engine from the config by @camgunz in #5402

Full Changelog: trufflesecurity/trufflehog@v3.99.1...v3.99.2

`v3.99.1`

Compare Source

What's Changed

Update github-actions by @renovate[bot] in #5363
[INT-1084] Make the results deduplication cache size configurable by @camgunz in #5399

Full Changelog: trufflesecurity/trufflehog@v3.99.0...v3.99.1

`v3.99.0`

Compare Source

What's Changed

Fix Sumo Logic detector ignoring configured verifier endpoints by @unsmith in #5395
Add OAuth2 (ROPC) auth for verification requests by @unsmith in #5392

Full Changelog: trufflesecurity/trufflehog@v3.98.1...v3.99.0

`v3.98.1`

Compare Source

What's Changed

Add postman source documentation by @kashifkhan0771 in #5389
Add a TruffleHog dectector for Kong Konnect Platform by @mrwanny in #5305
Add api_timeout_seconds to Gerrit source proto by @kashifkhan0771 in #5394

New Contributors

@mrwanny made their first contribution in #5305

Full Changelog: trufflesecurity/trufflehog@v3.98.0...v3.98.1

`v3.98.0`

Compare Source

What's Changed

Int 595 verify asymmetry by @shahzadhaider1 in #5261
return error body for fetchBearerToken by @jordanTunstill in #5301
Update module github.com/charmbracelet/bubbletea to v1.3.10 by @renovate[bot] in #5281
Update github.com/trufflesecurity/ldap-verify digest to 3142cc9 by @renovate[bot] in #5280
[INT-1086] Don't reuse maps; editing them afterwards edits them for all results by @camgunz in #5351
[INT-1091] Treat Square 403 as verified on INSUFFICIENT_SCOPES by @MuneebUllahKhan222 in #5367
feat: add --no-ignore-tag to report secrets on trufflehog:ignore lines by @thiswillnevermatch in #5293
Fix failing TestGHCRListImages test in CI by @MuneebUllahKhan222 in #5368
Revert duplicate --no-ignore-tag changes from #5293 by @shahzadhaider1 in #5369
Show progress inside S3 buckets by @shahzadhaider1 in #5330
fix(output): escape special characters in --github-actions output by @kenanyararbas in #5353
fix(detectors): remove stray fmt.Printf in portainertoken by @Gracy769 in #5334
resolve race condition in result deduplication cache by @kvnphvm in #5359
added entropy filter and improved verification for gitlab v2/v3 by @jordanTunstill in #5358
Update Okta domain pat to account for mil and fedramp by @kvnphvm in #5355
Corpora bench reports clean when a detector produces zero matches on both sides by @kvnphvm in #5357
Add huggingface source documentation by @kashifkhan0771 in #5373
Add Gitlab source documentation by @kashifkhan0771 in #5371
Add Github source documentation by @kashifkhan0771 in #5370
fix(detectors/auth0oauth): match Auth0 Private Cloud auth0app.com domains by @saghaulor in #5354
List only the include prefixes in S3 scans by @shahzadhaider1 in #5377
fix(github): switch back to fetching access token through apiClient, by @mariduv in #5380
Fix NetSuite detector running out of memory on dense input by @shahzadhaider1 in #5383
Add Jenkins source documentation by @kashifkhan0771 in #5388
docs: point five internal links at files that exist by @CalvinTjoaquinn in #5375
Add pkg/ssrf shared egress guard; use it for WithNoLocalIP and analyzer clients by @bill-rich in #5288

New Contributors

@thiswillnevermatch made their first contribution in #5293
@kenanyararbas made their first contribution in #5353
@Gracy769 made their first contribution in #5334
@CalvinTjoaquinn made their first contribution in #5375

Full Changelog: trufflesecurity/trufflehog@v3.97.9...v3.98.0

`v3.97.9`

Compare Source

What's Changed

[SCAN-162] Add Err() to JobProgress and JobProgressRef by @dipto-truffle in #5346
ci: scope Smoke timeouts to trufflehog runs, not the build by @bryanbeverly in #5317
Update module github.com/aymanbagabas/go-osc52 to v1.2.2 by @renovate[bot] in #5252
Update module github.com/gabriel-vasile/mimetype to v1.4.15 by @renovate[bot] in #5283
make 401s for Basic auth verified false. by @jordanTunstill in #5290
[INT-1088] Add version and comment_number lines to SharePoint source metadata by @camgunz in #5348
Int 595 auth errors by @shahzadhaider1 in #5259
Spruce up Makefile a little by @camgunz in #5347

Full Changelog: trufflesecurity/trufflehog@v3.97.8...v3.97.9

Configuration

📅 Schedule: (in timezone Europe/Zurich)

Branch creation
- "before 6am"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot requested a review from sbaerlocher as a code owner September 27, 2026 22:37

renovate Bot added the dependencies label Sep 27, 2026

renovate Bot force-pushed the renovate/github-actions branch 9 times, most recently from ec4fe9e to f8ee69a Compare October 5, 2026 21:57

renovate Bot force-pushed the renovate/github-actions branch 19 times, most recently from 3ee2ccd to 8eb7561 Compare October 13, 2026 15:29

renovate Bot force-pushed the renovate/github-actions branch 10 times, most recently from bf7f5a6 to 6387639 Compare October 18, 2026 13:53

chore(deps): Update GitHub Actions

a1c92e0

renovate Bot force-pushed the renovate/github-actions branch from 6387639 to a1c92e0 Compare October 18, 2026 21:22

sbaerlocher approved these changes Oct 19, 2026

View reviewed changes

Navigation Menu

Repository navigation

chore(deps): Update GitHub Actions - #175

chore(deps): Update GitHub Actions#175
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions

renovate Bot commented Sep 27, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

New Contributors

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

What's Changed

New Contributors

Added Features

Bug Fixes

What's Changed

New Contributors

What's Changed

v3.15.0: 3.15.0

v3.14.8: 3.14.8

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Sep 27, 2026 •

edited

Loading

`v3.15.0`: 3.15.0

`v3.14.8`: 3.14.8