chore(deps): bump the github-actions group across 1 directory with 14 updates by dependabot[bot] · Pull Request #63 · AION-by-ASA-Computer/AION_Agent

dependabot · 2026-07-20T02:57:44Z

Bumps the github-actions group with 14 updates in the / directory:

Package	From	To
astral-sh/setup-uv	`94527f2e458b27549849d47d273a16bec83a01e9`	`37802adc94f370d6bfd71619e3f0bf239e1f3b78`
actions/setup-node	`6.4.0`	`7.0.0`
pnpm/action-setup	`b0f76dfb45f55f8421693e4803ac7bb65143bd34`	`0ebf47130e4866e96fce0953f49152a61190b271`
docker/setup-buildx-action	`4.1.0`	`4.2.0`
github/codeql-action/init	`4.36.2`	`4.37.1`
github/codeql-action/autobuild	`4.36.2`	`4.37.1`
github/codeql-action/analyze	`4.36.2`	`4.37.1`
rhysd/actionlint	`1.7.7`	`1.7.12`
crate-ci/typos	`3e8e1dbf18c56a9ed625484ca941497c73e7da2c`	`37bb98842b0d8c4ffebdb75301a13db0267cef89`
google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml	`fa4ff678dd5d0a4fa3d628e57af8162873e93cd6`	`a82132c0bd6c7261ffcb78e754c46c70ab57ad9a`
google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml	`fa4ff678dd5d0a4fa3d628e57af8162873e93cd6`	`a82132c0bd6c7261ffcb78e754c46c70ab57ad9a`
docker/login-action	`4.3.0`	`4.4.0`
googleapis/release-please-action	`0dfd8538845b8e92600d271a895a5372865d4062`	`45996ed1f6d02564a971a2fa1b5860e934307cf7`
actions/stale	`10.3.0`	`10.4.0`

Updates astral-sh/setup-uv from 94527f2e458b27549849d47d273a16bec83a01e9 to 37802adc94f370d6bfd71619e3f0bf239e1f3b78

Commits

See full diff in compare view

Updates actions/setup-node from 6.4.0 to 7.0.0

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Add cache-primary-key and cache-matched-key as outputs by @gowridurgad in actions/setup-node#1577

Migrate to ESM and upgrade dependencies by @gowridurgad in actions/setup-node#1574

Bug fixes:

Remove dummy NODE_AUTH_TOKEN export by @gowridurgad in actions/setup-node#1558

Only use mirrorToken in getManifest if it's provided by @deiga in actions/setup-node#1548

Documentation updates:

Add documentation for publishing to npm with Trusted Publisher (OIDC) by @chiranjib-swain in actions/setup-node#1536

docs: Update restore-only cache documentation by @priya-kinthali in actions/setup-node#1550

docs: Update caching recommendations to mitigate cache poisoning risks by @chiranjib-swain in actions/setup-node#1567

Dependency update:

Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in actions/setup-node#1569

New Contributors

@chiranjib-swain made their first contribution in actions/setup-node#1536

@deiga made their first contribution in actions/setup-node#1548

@jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

Update @actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits

8207627 Migrate to ESM and upgrade dependencies (#1574)
04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
30eb73b Resolve high-severity audit issues
4e1a87a Update dist
360237f Strict equality
4f8aac5 Bump @actions/cache to 5.1.0, log cache write denied
f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
Additional commits viewable in compare view

Updates pnpm/action-setup from b0f76dfb45f55f8421693e4803ac7bb65143bd34 to 0ebf47130e4866e96fce0953f49152a61190b271

Commits

See full diff in compare view

Updates docker/setup-buildx-action from 4.1.0 to 4.2.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.2.0

Preserve names in esbuild bundle by @crazy-max in docker/setup-buildx-action#572

Bump @actions/core from 3.0.0 to 3.0.1 in docker/setup-buildx-action#551

Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/setup-buildx-action#557 docker/setup-buildx-action#580

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/setup-buildx-action#573

Bump @sigstore/verify from 3.1.0 to 3.1.1 in docker/setup-buildx-action#576

Bump js-yaml from 4.1.1 to 5.2.0 in docker/setup-buildx-action#562

Bump sigstore from 4.1.0 to 4.1.1 in docker/setup-buildx-action#577

Bump tmp from 0.2.5 to 0.2.7 in docker/setup-buildx-action#556

Bump undici from 6.25.0 to 6.27.0 in docker/setup-buildx-action#570

Bump vite from 7.3.2 to 7.3.6 in docker/setup-buildx-action#569

Full Changelog: docker/setup-buildx-action@v4.1.0...v4.2.0

Commits

bb05f3f Merge pull request #580 from docker/dependabot/npm_and_yarn/docker/actions-to...
321c814 [dependabot skip] chore: update generated content
b9a36ef build(deps): bump @docker/actions-toolkit from 0.91.0 to 0.92.0
ebeab24 Merge pull request #570 from docker/dependabot/npm_and_yarn/undici-6.27.0
5c7b8ae [dependabot skip] chore: update generated content
037e618 build(deps): bump undici from 6.25.0 to 6.27.0
66080e5 Merge pull request #577 from docker/dependabot/npm_and_yarn/sigstore-4.1.1
409aef0 Merge pull request #562 from docker/dependabot/npm_and_yarn/js-yaml-4.2.0
49c6e42 build(deps): bump sigstore from 4.1.0 to 4.1.1
2211273 [dependabot skip] chore: update generated content
Additional commits viewable in compare view

Updates github/codeql-action/init from 4.36.2 to 4.37.1

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.1

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

v4.37.0

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.1 - 16 Jul 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

... (truncated)

Commits

7188fc3 Merge pull request #4020 from github/update-v4.37.1-9e7c07009
c8b5f69 Update changelog for v4.37.1
9e7c070 Merge pull request #4014 from github/mbg/explicit-remote-prefix
3492b7e Change REMOTE_PATH_PREFIX to remote=
3654baa Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix
2d682ac Merge pull request #4017 from github/dependabot/github_actions/dot-github/wor...
23f6a50 Merge pull request #4009 from github/mbg/action-state/additions
1ee3c75 Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...
e053684 Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...
6803c56 Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.1
Additional commits viewable in compare view

Updates github/codeql-action/autobuild from 4.36.2 to 4.37.1

Release notes

Sourced from github/codeql-action/autobuild's releases.

v4.37.1

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

v4.37.0

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action/autobuild's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.1 - 16 Jul 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

... (truncated)

Commits

7188fc3 Merge pull request #4020 from github/update-v4.37.1-9e7c07009
c8b5f69 Update changelog for v4.37.1
9e7c070 Merge pull request #4014 from github/mbg/explicit-remote-prefix
3492b7e Change REMOTE_PATH_PREFIX to remote=
3654baa Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix
2d682ac Merge pull request #4017 from github/dependabot/github_actions/dot-github/wor...
23f6a50 Merge pull request #4009 from github/mbg/action-state/additions
1ee3c75 Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...
e053684 Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...
6803c56 Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.1
Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.36.2 to 4.37.1

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.1

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

v4.37.0

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.1 - 16 Jul 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

... (truncated)

Commits

7188fc3 Merge pull request #4020 from github/update-v4.37.1-9e7c07009
c8b5f69 Update changelog for v4.37.1
9e7c070 Merge pull request #4014 from github/mbg/explicit-remote-prefix
3492b7e Change REMOTE_PATH_PREFIX to remote=
3654baa Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix
2d682ac Merge pull request #4017 from github/dependabot/github_actions/dot-github/wor...
23f6a50 Merge pull request #4009 from github/mbg/action-state/additions
1ee3c75 Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...
e053684 Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...
6803c56 Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.1
Additional commits viewable in compare view

Updates rhysd/actionlint from 1.7.7 to 1.7.12

Release notes

Sourced from rhysd/actionlint's releases.

v1.7.12
Support the timezone configuration in on.schedule with checks for IANA timezone string. See the documentation for more details. Note that actionlint starts to embed the timezone database in the executables from this version so the binary sizes slightly increase. (#641, thanks @martincostello)
on:
  schedule:
    # ERROR: The timezone is not a valid IANA timezone string
    - cron: '*/5 * * * *'
      timezone: 'Asia/Somewhere'
Support the jobs.<job_name>.environment.deployment configuration. (#639, thanks @springmeyer)

Support the macos-26-intel runner label. (#629, thanks @hugovk)

Fix the outdated table of webhook activity types by rebuilding the script to scrape the table from scratch.

Support Go 1.26 and drop the support for Go 1.24. Now supported versions are 1.25 and 1.26.

Tests are run on arm64 Windows in CI.

Update the popular actions data set to the latest.
v1.7.11
Support the case() function in ${{ }} expressions which was recently added to GitHub Actions. (#612, #614, thanks @heppu)
env:
  # ERROR: case() requires an odd number of arguments
  ENVIRONMENT: |-
    ${{ case(
      github.ref == 'refs/heads/main', 'production',
      github.ref == 'refs/heads/staging', 'staging'
    ) }}
Support new macos-26-large and windows-2025-vs2026 runner labels. See the GitHub's announce for more details. (#615, thanks @hugovk and @muzimuzhi)
Enable Artifact attestations for the released binaries. From v1.7.11 gh command can verify the integrity of the downloaded binaries as follows. The verification is highly recommended in terms of supply chain security. (#608, thanks @takaram)
$ gh release download --repo rhysd/actionlint --pattern '*_darwin_amd64.tar.gz' v1.7.11
$ gh attestation verify --repo rhysd/actionlint actionlint_1.7.11_darwin_amd64.tar.gz
Loaded digest sha256:17ffc17fed8f0258ef6ad4aed932d3272464c7ef7d64e1cb0d65aa97c9752107 for file://actionlint_1.7.11_darwin_amd64.tar.gz
Loaded 1 attestation from GitHub API
The following policy criteria will be enforced:

Predicate type must match:................ https://slsa.dev/provenance/v1
Source Repository Owner URI must match:... https://github.com/rhysd
Source Repository URI must match:......... https://github.com/rhysd/actionlint
Subject Alternative Name must match regex: (?i)^https://github.com/rhysd/actionlint/
OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!
The following 1 attestation matched the policy criteria

Attestation #1

Build repo:..... rhysd/actionlint
Build workflow:. .github/workflows/release.yaml@refs/tags/v1.7.11
Signer repo:.... rhysd/actionlint

... (truncated)

Changelog

Sourced from rhysd/actionlint's changelog.

v1.7.12 - 2026-03-30
Support the timezone configuration in on.schedule with checks for IANA timezone string. See the documentation for more details. Note that actionlint starts to embed the timezone database in the executables from this version so the binary sizes slightly increase. (#641, thanks @martincostello)
on:
  schedule:
    # ERROR: The timezone is not a valid IANA timezone string
    - cron: '*/5 * * * *'
      timezone: 'Asia/Somewhere'
Support the jobs.<job_name>.environment.deployment configuration. (#639, thanks @springmeyer)

Support the macos-26-intel runner label. (#629, thanks @hugovk)

Fix the table of webhook activity types are outdated by rebuilding the script to scrape the table from scratch.

Support Go 1.26 and drop the support for Go 1.24. Now supported versions are 1.25 and 1.26.

Tests are run on arm64 Windows in CI.

Update the popular actions data set to the latest.
[Changes][v1.7.12]

v1.7.11 - 2026-02-14
Support the case() function in ${{ }} expressions which was recently added to GitHub Actions. (#612, #614, thanks @heppu)
env:
  # ERROR: case() requires an odd number of arguments
  ENVIRONMENT: |-
    ${{ case(
      github.ref == 'refs/heads/main', 'production',
      github.ref == 'refs/heads/staging', 'staging'
    ) }}
Support new macos-26-large and windows-2025-vs2026 runner labels. See the GitHub's announce for more details. (#615, thanks @hugovk and @muzimuzhi)
Enable Artifact attestations for the released binaries. From v1.7.11 gh command can verify the integrity of the downloaded binaries as follows. The verification is highly recommended in terms of supply chain security. (#608, thanks @takaram)
$ gh release download --repo rhysd/actionlint --pattern '*_darwin_amd64.tar.gz' v1.7.11
$ gh attestation verify --repo rhysd/actionlint actionlint_1.7.11_darwin_amd64.tar.gz
Loaded digest sha256:17ffc17fed8f0258ef6ad4aed932d3272464c7ef7d64e1cb0d65aa97c9752107 for file://actionlint_1.7.11_darwin_amd64.tar.gz
Loaded 1 attestation from GitHub API
The following policy criteria will be enforced:

Predicate type must match:................ https://slsa.dev/provenance/v1
Source Repository Owner URI must match:... https://github.com/rhysd
Source Repository URI must match:......... https://github.com/rhysd/actionlint
Subject Alternative Name must match regex: (?i)^https://github.com/rhysd/actionlint/
OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!

... (truncated)

Commits

914e7df bump up version to v1.7.12
f1fe8a1 update popular actions data set to the latest
0ef3e18 add support for https://github.blog/changelog/2026-03-19-github-actions-late-...
d2f9e65 update document to describe the timezone check in on.schedule
c03b271 Merge branch 'followup-issue641' (#641)
c9efd91 fix staticcheck checks files inside ./playground/node_modules
08e2336 include timezone database in executable statically
f48c0a4 fix timezone check is incomplete
6b811d3 fix problem matcher test fails due to line ending in test data
4897c1d Merge pull request #641 from martincostello/gh-638
Additional commits viewable in compare view

Updates crate-ci/typos from 3e8e1dbf18c56a9ed625484ca941497c73e7da2c to 37bb98842b0d8c4ffebdb75301a13db0267cef89

Changelog

Sourced from crate-ci/typos's changelog.

Change Log

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

[Unreleased] - ReleaseDate

[1.48.0] - 2026-06-30

Features

Updated the dictionary with the June 2026 changes

[1.47.2] - 2026-06-04

Fixes

Don't correct inferrable

Correct unused inferible variant

[1.47.1] - 2026-06-03

Fixes

Don't correct requestors

[1.47.0] - 2026-05-29

Features

Updated the dictionary with the May 2026 changes

[1.46.3] - 2026-05-23

Fixes

Don't correct to sequentials

Don't correct to subdolder

[1.46.2] - 2026-05-16

Fixes

Don't correct to criterias

Don't correct to replaceables

[1.46.1] - 2026-05-08

... (truncated)

Commits

See full diff in compare view

Updates google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from fa4ff678dd5d0a4fa3d628e57af8162873e93cd6 to a82132c0bd6c7261ffcb78e754c46c70ab57ad9a

Commits

a82132c Merge pull request #135 from google/fix-zizmor-excessive-permissions
272ff57 fix: address zizmor template injection warnings
10621fb refactor: move permissions to job level to satisfy zizmor
See full diff in compare view

Updates google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from fa4ff678dd5d0a4fa3d628e57af8162873e93cd6 to a82132c0bd6c7261ffcb78e754c46c70ab57ad9a

Commits

a82132c Merge pull request #135 from google/fix-zizmor-excessive-permissions
272ff57 fix: address zizmor template injection warnings
10621fb refactor: move permissions to job level to satisfy zizmor
See full diff in compare view

Updates docker/login-action from 4.3.0 to 4.4.0

Release notes

Sourced from docker/login-action's releases.

v4.4.0

Skip empty registry-auth secret mask by @crazy-max in docker/login-action#1035

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1077.0 docker/login-action#1034

Full Changelog: docker/login-action@v4.3.0...v4.4.0

Commits

af1e73f Merge pull request #1034 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
da722bd [dependabot skip] chore: update generated content
2916ad6 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
ca0a662 Merge pull request #1035 from crazy-max/fix-registry-auth-empty-mask
c455755 chore: update generated content
4835190 skip empty registry-auth secret mask
992421c Merge pull request #1033 from docker/dependabot/github_actions/docker/bake-ac...
b249b43 Merge pull request #1032 from docker/dependabot/github_actions/docker/bake-ac...
1b67977 build(deps): bump docker/bake-action from 7.2.0 to 7.3.0
9d49d6a build(deps): bump docker/bake-action/subaction/matrix
See full diff in compare view

Updates googleapis/release-please-action from 0dfd8538845b8e92600d271a895a5372865d4062 to 45996ed1f6d02564a971a2fa1b5860e934307cf7

Changelog

Sourced from googleapis/release-please-action's changelog.

Changelog

… updates Bumps the github-actions group with 14 updates in the / directory: | Package | From | To | | --- | --- | --- | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `94527f2e458b27549849d47d273a16bec83a01e9` | `37802adc94f370d6bfd71619e3f0bf239e1f3b78` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.0.0` | | [pnpm/action-setup](https://github.com/pnpm/action-setup) | `b0f76dfb45f55f8421693e4803ac7bb65143bd34` | `0ebf47130e4866e96fce0953f49152a61190b271` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.1.0` | `4.2.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.2` | `4.37.1` | | [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.36.2` | `4.37.1` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.2` | `4.37.1` | | [rhysd/actionlint](https://github.com/rhysd/actionlint) | `1.7.7` | `1.7.12` | | [crate-ci/typos](https://github.com/crate-ci/typos) | `3e8e1dbf18c56a9ed625484ca941497c73e7da2c` | `37bb98842b0d8c4ffebdb75301a13db0267cef89` | | [google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml](https://github.com/google/osv-scanner-action) | `fa4ff678dd5d0a4fa3d628e57af8162873e93cd6` | `a82132c0bd6c7261ffcb78e754c46c70ab57ad9a` | | [google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml](https://github.com/google/osv-scanner-action) | `fa4ff678dd5d0a4fa3d628e57af8162873e93cd6` | `a82132c0bd6c7261ffcb78e754c46c70ab57ad9a` | | [docker/login-action](https://github.com/docker/login-action) | `4.3.0` | `4.4.0` | | [googleapis/release-please-action](https://github.com/googleapis/release-please-action) | `0dfd8538845b8e92600d271a895a5372865d4062` | `45996ed1f6d02564a971a2fa1b5860e934307cf7` | | [actions/stale](https://github.com/actions/stale) | `10.3.0` | `10.4.0` | Updates `astral-sh/setup-uv` from 94527f2e458b27549849d47d273a16bec83a01e9 to 37802adc94f370d6bfd71619e3f0bf239e1f3b78 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@94527f2...37802ad) Updates `actions/setup-node` from 6.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@48b55a0...8207627) Updates `pnpm/action-setup` from b0f76dfb45f55f8421693e4803ac7bb65143bd34 to 0ebf47130e4866e96fce0953f49152a61190b271 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@b0f76df...0ebf471) Updates `docker/setup-buildx-action` from 4.1.0 to 4.2.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@d7f5e7f...bb05f3f) Updates `github/codeql-action/init` from 4.36.2 to 4.37.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@8aad20d...7188fc3) Updates `github/codeql-action/autobuild` from 4.36.2 to 4.37.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@8aad20d...7188fc3) Updates `github/codeql-action/analyze` from 4.36.2 to 4.37.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@8aad20d...7188fc3) Updates `rhysd/actionlint` from 1.7.7 to 1.7.12 - [Release notes](https://github.com/rhysd/actionlint/releases) - [Changelog](https://github.com/rhysd/actionlint/blob/main/CHANGELOG.md) - [Commits](rhysd/actionlint@03d0035...914e7df) Updates `crate-ci/typos` from 3e8e1dbf18c56a9ed625484ca941497c73e7da2c to 37bb98842b0d8c4ffebdb75301a13db0267cef89 - [Release notes](https://github.com/crate-ci/typos/releases) - [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md) - [Commits](crate-ci/typos@3e8e1db...37bb988) Updates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml` from fa4ff678dd5d0a4fa3d628e57af8162873e93cd6 to a82132c0bd6c7261ffcb78e754c46c70ab57ad9a - [Release notes](https://github.com/google/osv-scanner-action/releases) - [Commits](google/osv-scanner-action@fa4ff67...a82132c) Updates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml` from fa4ff678dd5d0a4fa3d628e57af8162873e93cd6 to a82132c0bd6c7261ffcb78e754c46c70ab57ad9a - [Release notes](https://github.com/google/osv-scanner-action/releases) - [Commits](google/osv-scanner-action@fa4ff67...a82132c) Updates `docker/login-action` from 4.3.0 to 4.4.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@c99871d...af1e73f) Updates `googleapis/release-please-action` from 0dfd8538845b8e92600d271a895a5372865d4062 to 45996ed1f6d02564a971a2fa1b5860e934307cf7 - [Release notes](https://github.com/googleapis/release-please-action/releases) - [Changelog](https://github.com/googleapis/release-please-action/blob/main/CHANGELOG.md) - [Commits](googleapis/release-please-action@0dfd853...45996ed) Updates `actions/stale` from 10.3.0 to 10.4.0 - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@eb5cf3a...1e223db) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 37802adc94f370d6bfd71619e3f0bf239e1f3b78 dependency-type: direct:production dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: pnpm/action-setup dependency-version: 0ebf47130e4866e96fce0953f49152a61190b271 dependency-type: direct:production dependency-group: github-actions - dependency-name: docker/setup-buildx-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/autobuild dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: rhysd/actionlint dependency-version: 1.7.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: crate-ci/typos dependency-version: 37bb98842b0d8c4ffebdb75301a13db0267cef89 dependency-type: direct:production dependency-group: github-actions - dependency-name: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml dependency-version: a82132c0bd6c7261ffcb78e754c46c70ab57ad9a dependency-type: direct:production dependency-group: github-actions - dependency-name: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml dependency-version: a82132c0bd6c7261ffcb78e754c46c70ab57ad9a dependency-type: direct:production dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: googleapis/release-please-action dependency-version: 45996ed1f6d02564a971a2fa1b5860e934307cf7 dependency-type: direct:production dependency-group: github-actions - dependency-name: actions/stale dependency-version: 10.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-20T02:57:45Z

Labels

The following labels could not be found: dependabot. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

vercel · 2026-07-20T02:57:47Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
aion-agent	Ready	Preview, Comment	Jul 20, 2026 3:12am

dependabot · 2026-07-27T02:57:02Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 20, 2026

dependabot Bot requested a review from a team as a code owner July 20, 2026 02:57

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 20, 2026

vercel Bot deployed to Preview July 20, 2026 03:12 View deployment

dependabot Bot closed this Jul 27, 2026

dependabot Bot deleted the dependabot/github_actions/github-actions-f673e2bb50 branch July 27, 2026 02:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the github-actions group across 1 directory with 14 updates - #63

chore(deps): bump the github-actions group across 1 directory with 14 updates#63
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-f673e2bb50

dependabot Bot commented on behalf of github Jul 20, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jul 20, 2026

Uh oh!

vercel Bot commented Jul 20, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

v6.5.0

What's Changed

v4.2.0

v4.37.1

v4.37.0

v4.36.3

CodeQL Action Changelog

[UNRELEASED]

4.37.1 - 16 Jul 2026

4.37.0 - 08 Jul 2026

4.36.3 - 01 Jul 2026

4.36.2 - 04 Jun 2026

4.36.1 - 02 Jun 2026

4.36.0 - 22 May 2026

4.35.5 - 15 May 2026

4.35.4 - 07 May 2026

4.35.3 - 01 May 2026

v4.37.1

v4.37.0

v4.36.3

CodeQL Action Changelog

[UNRELEASED]

4.37.1 - 16 Jul 2026

4.37.0 - 08 Jul 2026

4.36.3 - 01 Jul 2026

4.36.2 - 04 Jun 2026

4.36.1 - 02 Jun 2026

4.36.0 - 22 May 2026

4.35.5 - 15 May 2026

4.35.4 - 07 May 2026

4.35.3 - 01 May 2026

v4.37.1

v4.37.0

v4.36.3

CodeQL Action Changelog

[UNRELEASED]

4.37.1 - 16 Jul 2026

4.37.0 - 08 Jul 2026

4.36.3 - 01 Jul 2026

4.36.2 - 04 Jun 2026

4.36.1 - 02 Jun 2026

4.36.0 - 22 May 2026

4.35.5 - 15 May 2026

4.35.4 - 07 May 2026

4.35.3 - 01 May 2026

v1.7.12

v1.7.11

v1.7.12 - 2026-03-30

v1.7.11 - 2026-02-14

Change Log

[Unreleased] - ReleaseDate

[1.48.0] - 2026-06-30

Features

[1.47.2] - 2026-06-04

Fixes

[1.47.1] - 2026-06-03

Fixes

[1.47.0] - 2026-05-29

Features

[1.46.3] - 2026-05-23

Fixes

[1.46.2] - 2026-05-16

Fixes

[1.46.1] - 2026-05-08

v4.4.0

Changelog

Uh oh!

dependabot Bot commented on behalf of github Jul 20, 2026

Labels

dependabot Bot commented on behalf of github Jul 20, 2026 •

edited

Loading

vercel Bot commented Jul 20, 2026 •

edited

Loading