deps(deps): bump the github-actions group across 1 directory with 6 updates by dependabot[bot] · Pull Request #181 · microsoft/kompli

dependabot · 2026-10-26T06:21:21Z

Bumps the github-actions group with 6 updates in the / directory:

Package	From	To
docker/login-action	`4.6.0`	`4.7.0`
github/codeql-action/init	`4.39.0`	`4.39.1`
github/codeql-action/analyze	`4.39.0`	`4.39.1`
actions/setup-python	`7.0.0`	`7.1.0`
github/codeql-action/upload-sarif	`4.39.0`	`4.39.1`
trufflesecurity/trufflehog	`3.99.2`	`3.99.7`

Updates docker/login-action from 4.6.0 to 4.7.0

Release notes

Sourced from docker/login-action's releases.

v4.7.0

Preserve explicit ECR settings in registry-auth by @crazy-max in docker/login-action#1089

Use registry hosts for scoped credentials by @crazy-max in docker/login-action#1088

Raise Docker Hub OIDC max expiry to 6 hours by @crazy-max in docker/login-action#1068

Log Docker Hub OIDC token exchange progress by @crazy-max in docker/login-action#1061

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1154.0 in docker/login-action#1093

Bump @docker/actions-toolkit from 0.94.0 to 0.107.0 in docker/login-action#1100

Bump @humanfs/node from 0.16.7 to 0.16.8 in docker/login-action#1077

Bump csv-parse from 7.0.1 to 7.0.3 in docker/login-action#1078

Bump handlebars from 4.7.9 to 4.7.10 in docker/login-action#1091

Bump js-yaml from 5.2.2 to 5.5.0 in docker/login-action#1066

Bump postcss from 8.5.22 to 8.5.26 in docker/login-action#1071

Bump postcss-selector-parser from 7.1.1 to 7.1.6 in docker/login-action#1092

Bump source-map-js from 1.2.1 to 1.2.2 in docker/login-action#1090

Bump undici from 6.27.0 to 6.29.1 in docker/login-action#1085

Bump uuid from 14.0.1 to 14.0.3 in docker/login-action#1096

Full Changelog: docker/login-action@v4.6.0...v4.7.0

Commits

81c6f93 Merge pull request #1100 from docker/dependabot/npm_and_yarn/docker/actions-t...
1b16c8d Merge pull request #1096 from docker/dependabot/npm_and_yarn/uuid-14.0.3
ac86b5e [dependabot skip] chore: update generated content
1476d84 build(deps): bump @docker/actions-toolkit from 0.94.0 to 0.107.0
503cee6 Merge pull request #1095 from docker/dependabot/github_actions/actions/create...
f093535 Merge pull request #1099 from docker/dependabot/github_actions/codecov/codeco...
d5ae7f1 Merge pull request #1098 from docker/dependabot/github_actions/docker/bake-ac...
6f97507 Merge pull request #1097 from docker/dependabot/github_actions/docker/bake-ac...
006d61f Merge pull request #1094 from docker/dependabot/github_actions/codeql-actions...
93f5f52 Merge pull request #1093 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
Additional commits viewable in compare view

Updates github/codeql-action/init from 4.39.0 to 4.39.1

Release notes

Sourced from github/codeql-action/init's releases.

v4.39.1

Update default CodeQL bundle version to 2.27.3. #4256

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.1 - 21 Oct 2026

Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148

Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206

The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

Update default CodeQL bundle version to 2.26.3. #4085

... (truncated)

Commits

9b32540 Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f
b5e1ed9 Trigger workflows
20f5ec3 Update changelog for v4.39.1
c5a2f4b Merge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching
61a5a80 Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.3
3dd33f8 Merge pull request #4249 from github/mbg/upload-improvements-for-4223
b96e339 Change comment for getConfig call in upload-sarif
7fa4518 Use shouldSkipSarifUpload in analyze-action.ts
a69c7cb Document that setting the env vars to false takes precedence
74ddcd9 Fix typo in comment
Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.39.0 to 4.39.1

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.39.1

Update default CodeQL bundle version to 2.27.3. #4256

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.1 - 21 Oct 2026

Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148

Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206

The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

Update default CodeQL bundle version to 2.26.3. #4085

... (truncated)

Commits

9b32540 Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f
b5e1ed9 Trigger workflows
20f5ec3 Update changelog for v4.39.1
c5a2f4b Merge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching
61a5a80 Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.3
3dd33f8 Merge pull request #4249 from github/mbg/upload-improvements-for-4223
b96e339 Change comment for getConfig call in upload-sarif
7fa4518 Use shouldSkipSarifUpload in analyze-action.ts
a69c7cb Document that setting the env vars to false takes precedence
74ddcd9 Fix typo in comment
Additional commits viewable in compare view

Updates actions/setup-python from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

Add mirror and mirror-token inputs for custom Python distribution sources by @luhenry in actions/setup-python#1302

Improve error message clarity by @v-lmvysakh in actions/setup-python#1351

Dependency Upgrade

Upgrade browserslist from 4.28.2 to 4.28.9 by @dependabot in actions/setup-python#1353

Upgrade @typescript-eslint/parser from 8.62.0 to 8.70.0 by @dependabot in actions/setup-python#1343

Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @dependabot in actions/setup-python#1342

Upgrade @vercel/ncc from 0.44.0 to 0.45.0 by @dependabot in actions/setup-python#1357

Upgrade @types/semver from 7.7.1 to 7.8.0 by @dependabot in actions/setup-python#1359

Upgrade undici from 6.28.0 to 6.29.0 by @dependabot in actions/setup-python#1364

Upgrade ts-jest from 29.4.11 to 29.4.14 by @dependabot in actions/setup-python#1361

Upgrade brace-expansion from 5.0.9 to 5.0.12 by @dependabot in actions/setup-python#1365

Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @dependabot in actions/setup-python#1363

Upgrade @typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @dependabot in actions/setup-python#1369

Upgrade actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-python#1345

Upgrade cache to 6.3.0 by @v-HarithaVattikuti in actions/setup-python#1370

Resolve Basic Validation audit failures by @v-HarithaVattikuti in actions/setup-python#1347

Resolve npm audit failures by @v-HarithaVattikuti in actions/setup-python#1350

New Contributors

@luhenry made their first contribution in actions/setup-python#1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

Commits

6d4fd22 Cache upgrade to 6.3.0 (#1370)
ec52d0a Bump @typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
e1be392 Bump @types/semver from 7.7.1 to 7.8.0 (#1359)
06da627 Bump @vercel/ncc from 0.44.0 to 0.45.0 (#1357)
af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
7aeabeb Bump @typescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.39.0 to 4.39.1

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.39.1

Update default CodeQL bundle version to 2.27.3. #4256

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.1 - 21 Oct 2026

Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148

Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206

The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

Update default CodeQL bundle version to 2.26.3. #4085

... (truncated)

Commits

9b32540 Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f
b5e1ed9 Trigger workflows
20f5ec3 Update changelog for v4.39.1
c5a2f4b Merge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching
61a5a80 Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.3
3dd33f8 Merge pull request #4249 from github/mbg/upload-improvements-for-4223
b96e339 Change comment for getConfig call in upload-sarif
7fa4518 Use shouldSkipSarifUpload in analyze-action.ts
a69c7cb Document that setting the env vars to false takes precedence
74ddcd9 Fix typo in comment
Additional commits viewable in compare view

Updates trufflesecurity/trufflehog from 3.99.2 to 3.99.7

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.99.7

What's Changed

Fix --include-wikis help typo and huggingface README description by @protonnegativo in trufflesecurity/trufflehog#5471

fix(detectors/anypointoauth2): stop treating HTTP 422 as verified by @jamesgol in trufflesecurity/trufflehog#5386

Add xAI analyzer by @serval-frenchie in trufflesecurity/trufflehog#5456

ci(lint): pin the semgrep container image by digest by @Portll in trufflesecurity/trufflehog#5245

feat(detectors): add Fireworks AI API key detector by @sudo-a-man in trufflesecurity/trufflehog#5447

feat(detectors): add Infisical service token detector by @Varshith-Kali in trufflesecurity/trufflehog#5445

Fix 7z and rar panics in the archive handler and log recovered panic stacks by @dustin-decker in trufflesecurity/trufflehog#5474

New Contributors

@protonnegativo made their first contribution in trufflesecurity/trufflehog#5471

@serval-frenchie made their first contribution in trufflesecurity/trufflehog#5456

@Portll made their first contribution in trufflesecurity/trufflehog#5245

@sudo-a-man made their first contribution in trufflesecurity/trufflehog#5447

@Varshith-Kali made their first contribution in trufflesecurity/trufflehog#5445

Full Changelog: trufflesecurity/trufflehog@v3.99.6...v3.99.7

v3.99.6

v3.99.5 was tagged but never published because its release build failed. v3.99.6 supersedes it and includes all of the changes below.

What's Changed

Update github-actions by @renovate[bot] in trufflesecurity/trufflehog#5414

Prefer nearest client/tenant IDs for Azure SP secrets by @kashifkhan0771 in trufflesecurity/trufflehog#5449

Clean up Filesystem source logging for per-source debug by @kashifkhan0771 in trufflesecurity/trufflehog#5465

security: bump andybalholm/brotli to v1.2.7 (CVE-2026-111497) by @dustin-decker in trufflesecurity/trufflehog#5472

Keep GoReleaser temp files off the tmpfs /tmp in releases by @dustin-decker in trufflesecurity/trufflehog#5473

Full Changelog: trufflesecurity/trufflehog@v3.99.4...v3.99.6

v3.99.4

What's Changed

Add per-source debug option and hide sensitive data in debug logs by @kashifkhan0771 in trufflesecurity/trufflehog#5446

Mark results whose verification was skipped by @unsmith in trufflesecurity/trufflehog#5448

Clean up Git source logging for per-source debug by @kashifkhan0771 in trufflesecurity/trufflehog#5451

Add Lambda Cloud API key detector by @lukem-ts in trufflesecurity/trufflehog#5435

Update github.com/trufflesecurity/ldap-verify digest to 4a15faf by @renovate[bot] in trufflesecurity/trufflehog#5441

Update dependency trufflesecurity/.github to v1.0.5 by @renovate[bot] in trufflesecurity/trufflehog#5442

Update module golang.org/x/crypto to v0.56.0 [SECURITY] by @renovate[bot] in trufflesecurity/trufflehog#5462

Update module golang.org/x/net to v0.60.0 [SECURITY] by @renovate[bot] in trufflesecurity/trufflehog#5464

Update module github.com/yuin/goldmark to v1.7.17 [SECURITY] by @renovate[bot] in trufflesecurity/trufflehog#5460

github: check App installation grants before listing comments by @unsmith in trufflesecurity/trufflehog#5454

Full Changelog: trufflesecurity/trufflehog@v3.99.3...v3.99.4

v3.99.3

What's Changed

... (truncated)

Commits

31ce31e Fix 7z and rar panics in the archive handler and log recovered panic stacks (...
50bc667 feat(detectors): add Infisical service token detector (#5445)
4723140 feat(detectors): add Fireworks AI API key detector (#5447)
8276bc4 ci(lint): pin the semgrep container image by digest (#5245)
f6984be Add xAI analyzer (#5456)
282085c fix(detectors/anypointoauth2): stop treating HTTP 422 as verified (#5386)
b1bb823 Fix --include-wikis help typo and huggingface README description (#5471)
fd43a88 Keep GoReleaser temp files off the tmpfs /tmp in releases (#5473)
3bd461f security: bump andybalholm/brotli to v1.2.7 (CVE-2026-111497) (#5472)
d6ea4a5 Clean up Filesystem source logging for per-source debug (#5465)
Additional commits viewable in compare view

Copilot

🟢 Approval recommended

These consistent, SHA-pinned minor and patch updates match the supplied release metadata and have no identified compatibility issues with existing workflows.

No open issues 🎉

What changed in this PR

Updates SHA-pinned GitHub Actions dependencies used by Kompli’s build, analysis, and security workflows without changing workflow inputs or application code.

Changes:

Updates Docker login to v4.7.0 across seven workflows.
Updates CodeQL initialization, analysis, and SARIF upload to v4.39.1.
Updates Python setup to v7.1.0 and TruffleHog to v3.99.7.

File	Description
`.github/workflows/telemetry-build.yml`	Updates Docker login for telemetry builds.
`.github/workflows/secret-scanning.yml`	Updates TruffleHog secret scanning.
`.github/workflows/scorecard.yml`	Updates CodeQL SARIF upload.
`.github/workflows/package-build.yml`	Updates Docker login for package builds.
`.github/workflows/fuzzing-run.yml`	Updates Docker login for fuzzing runs.
`.github/workflows/formatting.yml`	Updates the Python setup action.
`.github/workflows/codeql.yml`	Updates CodeQL initialization and analysis together.
`.github/workflows/ci.yml`	Updates Docker login for standard CI.
`.github/workflows/ci-sanitizers.yml`	Updates Docker login for sanitizer CI.
`.github/workflows/ci-gcovr.yml`	Updates Docker login for coverage CI.
`.github/workflows/build-containers.yml`	Updates Docker login for container builds.

_{Review effort: Balanced}

github-actions · 2026-10-26T06:36:33Z

Test Results

1 674 tests ±0 1 673 ✅ ±0 20s ⏱️ ±0s
91 suites ±0 1 💤 ±0
1 files ±0 0 ❌ ±0

Results for commit 414b47a. ± Comparison against base commit 9792d0d.

♻️ This comment has been updated with latest results.

…pdates Bumps the github-actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [docker/login-action](https://github.com/docker/login-action) | `4.6.0` | `4.7.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.39.0` | `4.39.1` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.39.0` | `4.39.1` | | [actions/setup-python](https://github.com/actions/setup-python) | `7.0.0` | `7.1.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.39.0` | `4.39.1` | | [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) | `3.99.2` | `3.99.7` | Updates `docker/login-action` from 4.6.0 to 4.7.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@dbcb813...81c6f93) Updates `github/codeql-action/init` from 4.39.0 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@6f2ac81...9b32540) Updates `github/codeql-action/analyze` from 4.39.0 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@6f2ac81...9b32540) Updates `actions/setup-python` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@5fda3b9...6d4fd22) Updates `github/codeql-action/upload-sarif` from 4.39.0 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@6f2ac81...9b32540) Updates `trufflesecurity/trufflehog` from 3.99.2 to 3.99.7 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@e76dff8...31ce31e) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: trufflesecurity/trufflehog dependency-version: 3.99.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

…d70e17f

dependabot · 2026-11-09T06:20:10Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot requested a review from a team October 26, 2026 06:21

dependabot Bot added the dependencies Use this label when updating dependencies e.g. vcpkg packages that we use or github-actions versions label Oct 26, 2026

Copilot AI balanced review requested due to automatic review settings October 26, 2026 06:21

dependabot Bot added the github-actions Use this label when updating github-actions label Oct 26, 2026

Copilot started reviewing October 26, 2026 06:21

View session

Copilot AI reviewed Oct 26, 2026

View reviewed changes

dependabot Bot changed the title ~~deps(deps): bump the github-actions group with 6 updates~~ deps(deps): bump the github-actions group across 1 directory with 6 updates Nov 2, 2026

dependabot Bot force-pushed the dependabot/github_actions/github-actions-e07d70e17f branch from ec87857 to 805004f Compare November 2, 2026 06:20

Merge branch 'main' into dependabot/github_actions/github-actions-e07…

414b47a

…d70e17f

Krzysztof Kanas (kkanas) approved these changes Nov 6, 2026

View reviewed changes

dependabot Bot closed this Nov 9, 2026

dependabot Bot deleted the dependabot/github_actions/github-actions-e07d70e17f branch November 9, 2026 06:20

Navigation Menu

Repository navigation

deps(deps): bump the github-actions group across 1 directory with 6 updates - #181

deps(deps): bump the github-actions group across 1 directory with 6 updates#181
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/github_actions/github-actions-e07d70e17f

dependabot Bot commented on behalf of github Oct 26, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Nov 9, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.7.0

v4.39.1

CodeQL Action Changelog

[UNRELEASED]

4.39.1 - 21 Oct 2026

4.39.0 - 15 Oct 2026

4.38.3 - 08 Oct 2026

4.38.2 - 24 Sept 2026

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

4.37.9 - 26 Aug 2026

4.37.8 - 21 Aug 2026

4.37.7 - 13 Aug 2026

v4.39.1

CodeQL Action Changelog

[UNRELEASED]

4.39.1 - 21 Oct 2026

4.39.0 - 15 Oct 2026

4.38.3 - 08 Oct 2026

4.38.2 - 24 Sept 2026

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

4.37.9 - 26 Aug 2026

4.37.8 - 21 Aug 2026

4.37.7 - 13 Aug 2026

v7.1.0

What's Changed

Enhancements

Dependency Upgrade

New Contributors

v4.39.1

CodeQL Action Changelog

[UNRELEASED]

4.39.1 - 21 Oct 2026

4.39.0 - 15 Oct 2026

4.38.3 - 08 Oct 2026

4.38.2 - 24 Sept 2026

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

4.37.9 - 26 Aug 2026

4.37.8 - 21 Aug 2026

4.37.7 - 13 Aug 2026

v3.99.7

What's Changed

New Contributors

v3.99.6

What's Changed

v3.99.4

What's Changed

v3.99.3

What's Changed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

github-actions Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

Uh oh!

dependabot Bot commented on behalf of github Nov 9, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Oct 26, 2026 •

edited

Loading

github-actions Bot commented Oct 26, 2026 •

edited

Loading