Bump the github-actions group across 1 directory with 11 updates by dependabot[bot] · Pull Request #2749 · sillsdev/languageforge-lexbox

dependabot · 2026-10-12T14:01:23Z

Bumps the github-actions group with 11 updates in the / directory:

Package	From	To
docker/build-push-action	`7.3.0`	`7.4.0`
github/codeql-action/init	`4.37.7`	`4.38.3`
github/codeql-action/analyze	`4.37.7`	`4.38.3`
mikefarah/yq	`4.53.3`	`4.54.1`
EndBug/add-and-commit	`11.0.0`	`11.1.1`
pnpm/action-setup	`6.0.10`	`6.1.0`
actions/setup-node	`7.0.0`	`7.1.0`
actions/upload-artifact	`7.0.1`	`7.0.2`
actions/download-artifact	`8.0.1`	`8.0.2`
softprops/action-gh-release	`3.0.2`	`3.0.3`
docker/setup-buildx-action	`4.2.0`	`4.4.1`

Updates docker/build-push-action from 7.3.0 to 7.4.0

Release notes

Sourced from docker/build-push-action's releases.

v7.4.0

Use the shared error helper for Buildx commands by @crazy-max in docker/build-push-action#1620

Prevent workflow command injection in metadata logs by @crazy-max in docker/build-push-action#1617

Bump @docker/actions-toolkit from 0.92.0 to 0.100.0 in docker/build-push-action#1614 docker/build-push-action#1618 docker/build-push-action#1621

Bump @humanfs/node from 0.16.7 to 0.16.8 in docker/build-push-action#1609

Bump brace-expansion from 1.1.13 to 1.1.18 in docker/build-push-action#1592

Bump csv-parse from 7.0.0 to 7.0.2 in docker/build-push-action#1613

Bump js-yaml from 4.3.0 to 4.3.2 in docker/build-push-action#1605 docker/build-push-action#1615

Bump nanoid from 3.3.16 to 3.3.18 in docker/build-push-action#1611

Bump postcss from 8.5.10 to 8.5.25 in docker/build-push-action#1590

Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/build-push-action#1606

Bump sigstore from 4.1.0 to 4.1.1 in docker/build-push-action#1577

Bump undici from 6.27.0 to 6.28.0 in docker/build-push-action#1594

Full Changelog: docker/build-push-action@v7.3.0...v7.4.0

Commits

c3c9e26 Merge pull request #1621 from docker/dependabot/npm_and_yarn/docker/actions-t...
459b674 [dependabot skip] chore: update generated content
4dedcb2 chore(deps): Bump @docker/actions-toolkit from 0.99.0 to 0.100.0
379bf63 Merge pull request #1620 from crazy-max/buildx-error-message
9877975 chore: update generated content
7ed0556 use the shared Buildx error summary helper
91670ba Merge pull request #1618 from docker/dependabot/npm_and_yarn/docker/actions-t...
80dbc86 [dependabot skip] chore: update generated content
50cac3a chore(deps): Bump @docker/actions-toolkit from 0.98.0 to 0.99.0
03b4d6c Merge pull request #1617 from crazy-max/fix-metadata-workflow-commands
Additional commits viewable in compare view

Updates github/codeql-action/init from 4.37.7 to 4.38.3

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.3

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

v4.38.2

Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

4.38.3 - 08 Oct 2026

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

... (truncated)

Commits

24c5418 Merge pull request #4214 from github/update-v4.38.3-e0b52dbdc
69e87c5 Add changelog note for #4184
23b6828 Update changelog for v4.38.3
e0b52db Merge pull request #4210 from github/henrymercer/pin-python-for-older-clis-in-ci
6b99698 Pin Python 3.13.15 for older CLI versions in multi-language check
63d3d63 Merge pull request #4203 from github/update-bundle/codeql-bundle-v2.27.2
7377a10 Add changelog note
c1a30cd Update default bundle to codeql-bundle-v2.27.2
d208ec7 Merge pull request #4200 from github/mbg/esm/migrate-pr-checks
a71b0c6 Replace __dirname in sync.ts
Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.7 to 4.38.3

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.38.3

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

v4.38.2

Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

4.38.3 - 08 Oct 2026

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

... (truncated)

Commits

24c5418 Merge pull request #4214 from github/update-v4.38.3-e0b52dbdc
69e87c5 Add changelog note for #4184
23b6828 Update changelog for v4.38.3
e0b52db Merge pull request #4210 from github/henrymercer/pin-python-for-older-clis-in-ci
6b99698 Pin Python 3.13.15 for older CLI versions in multi-language check
63d3d63 Merge pull request #4203 from github/update-bundle/codeql-bundle-v2.27.2
7377a10 Add changelog note
c1a30cd Update default bundle to codeql-bundle-v2.27.2
d208ec7 Merge pull request #4200 from github/mbg/esm/migrate-pr-checks
a71b0c6 Replace __dirname in sync.ts
Additional commits viewable in compare view

Updates mikefarah/yq from 4.53.3 to 4.54.1

Release notes

Sourced from mikefarah/yq's releases.

v4.54.1 - if-then-else

Added jq style if-then-elif-else-end conditional operator (#2871) Thanks to @anandghegde

Added @base64url/@base64urld operators (RFC 4648 §5) (#2827) Thanks @MsfPablo

Fixed: preserve explicit assignments in read-only expressions (#2850) Thanks @RRXXZZYY

Fixed: error on int64 overflow in +, -, * instead of silently wrapping (#2826) Thanks @MsfPablo

Fixed(toml): quote empty keys (#2870) Thanks @jakezwang

Fixed: /dev/null was triggering colour output (#2852) Thanks @laraibg786

Fixed dead snapcraft confinement link in README (#2840) Thanks @ShurongCAO

Bumped dependencies

v4.53.6

Fixing release build issue

Fixed line wrapping bug (#2824, #2823) Thanks @mxey

Bumped dependencies

v4.53.4

Close input files after processing each one (#2796) (#2808) Thanks @MsfPablo

Fixed non string HCL string keys (#2795)

Fixed heap allocation bug (#2809) Thanks @MsfPablo

Fix deleting commented empty list YAML output (#2765) Thanks @dpersek

Fix (has) return false for negative array indices (#2769) Thanks @maximilize

Fix (sort): avoid int64 overflow comparing large integers (#2771) Thanks @maximilize

Fix: preserve correct parent references in explode merge anchor reconstruction (#2730) Thanks @vomba

Improve Guard ExpressionParser initialization with sync.Once (#2789) Thanks @arcaven

Fix: reject negative indent instead of panicking (#2746) Thanks @StressTestor

Fix: parse signed hex and octal integers (#2749) Thanks @StressTestor

Fix: skip UTF-8 BOM when processing front matter (#2751) Thanks @StressTestor

Fix !!merge tag regression for yq (#2705) Thanks @W-Floyd

Default to yaml when a file's extension is not a recognised format (#2785) Thanks @devthedevil

Bumped dependencies

Changelog

Sourced from mikefarah/yq's changelog.

4.54.1:

Added jq style if-then-elif-else-end conditional operator (#2871) Thanks @anandghegde

Added @base64url/@base64urld operators (RFC 4648 §5) (#2827) Thanks @MsfPablo

Fixed: preserve explicit assignments in read-only expressions (#2850) Thanks @RRXXZZYY

Fixed: error on int64 overflow in +, -, * instead of silently wrapping (#2826) Thanks @MsfPablo

Fixed(toml): quote empty keys (#2870) Thanks @jakezwang

Fixed: /dev/null was triggering colour output (#2852) Thanks @laraibg786

Fixed dead snapcraft confinement link in README (#2840) Thanks @ShurongCAO

Bumped dependencies

4.53.6:

Fixing release build issue

4.53.5:

Fixed line wrapping bug (#2824, #2823) Thanks mxey

Bumped dependencies

4.53.4:

Close input files after processing each one (#2796) (#2808) Thanks @MsfPablo

Fixed non string HCL string keys (#2795)

Fixed heap allocation bug (#2809) Thanks @MsfPablo

Fix deleting commented empty list YAML output (#2765) Thanks @dpersek

Fix (has) return false for negative array indices (#2769) Thanks @maximilize

Fix (sort): avoid int64 overflow comparing large integers (#2771) Thanks @maximilize

Fix: preserve correct parent references in explode merge anchor reconstruction (#2730) Thanks @vomba

Improve Guard ExpressionParser initialization with sync.Once (#2789) Thanks @arcaven

Fix: reject negative indent instead of panicking (#2746) Thanks @StressTestor

Fix: parse signed hex and octal integers (#2749) Thanks @StressTestor

Fix: skip UTF-8 BOM when processing front matter (#2751) Thanks @StressTestor

Fix !!merge tag regression for yq (#2705) Thanks @W-Floyd

Default to yaml when a file's extension is not a recognised format (#2785) Thanks @devthedevil

Bumped dependencies

4.53.3:

Add --ini-preserve-quotes flag for INI round-trip quote preservation (#2728) Thanks @toller892!

Fix: reset INI decoder state on init (#2719) Thanks @xieby1!

Fix: decode properties array bracket paths (#2693) Thanks @cyphercodes!

Fix: preserve floats with trailing zero when encoding YAML to JSON (#2701) Thanks @ChrisJr404!

Fix: JSON to TOML root scope and null handling (#2689) Thanks @LovesAsuna!

Fix: reset TOML decoder finished flag on Init for multi-doc evaluation (#2704) Thanks @terminalchai!

Fix: reset TOML decoder between files when evaluating all at once (#2685) Thanks @terminalchai!

Fix: preserve TOML inline table array scope (#2694) Thanks @cyphercodes!

Fix: preserve empty TOML arrays in tables (#2686) Thanks @cyphercodes!

Fix: TOML encoder uses inline tables for YAML FlowStyle mappings (#2687)

Fix nested inline YAML merge explode (#2699) Thanks @cyphercodes!

Fix repeatString overflow test on 32-bit platforms (#2680) Thanks @jandubois!

Bumped dependencies

4.53.2:

Fixing release process

... (truncated)

Commits

504fc38 Bumping version
36855b4 build(deps): bump docker/login-action from 4.4.0 to 4.6.0 (#2802)
9f1856f build(deps): bump github/codeql-action/upload-sarif (#2842)
9790d69 build(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 (#2841)
46cf9ee Removed go version from AGENTs.md
4d5f0bd feat: add jq style if-then-elif-else-end conditionals (#2871)
338eca4 Fixing assignment with merge (#2883)
16f16fe fix: preserve explicit assignments in read-only expressions (#2850)
3d6d2bc build(deps): bump github.com/magiconair/properties (#2877)
64b0bd7 build(deps): bump github.com/hashicorp/hcl/v2 from 2.24.0 to 2.25.0 (#2878)
Additional commits viewable in compare view

Updates EndBug/add-and-commit from 11.0.0 to 11.1.1

Release notes

Sourced from EndBug/add-and-commit's releases.

v11.1.1

What's Changed

docs: highlight untrusted git-arg interpolation as a warning callout by @EndBug in EndBug/add-and-commit#781

fix: Remove GH var interpolation in action.yml docstring by @dzcode in EndBug/add-and-commit#783

fix: validate denylisted git args on every token by @EndBug in EndBug/add-and-commit#784

New Contributors

@dzcode made their first contribution in EndBug/add-and-commit#783

Full Changelog: EndBug/add-and-commit@v11.1.0...v11.1.1

v11.1.0

What's Changed

feat: add push_attempts to retry failed pushes by @EndBug in EndBug/add-and-commit#764

test: add integration tests for the shipped action by @EndBug in EndBug/add-and-commit#766

feat: add dry_run input by @EndBug in EndBug/add-and-commit#765

docs: add nmattia as a contributor for ideas by @allcontributors[bot] in EndBug/add-and-commit#767

docs: add jcbhmr as a contributor for ideas by @allcontributors[bot] in EndBug/add-and-commit#768

fix: reject remote-helper overrides skipped by -u by @EndBug in EndBug/add-and-commit#770

fix: block scheme:: remote helpers and restrict git transports by @EndBug in EndBug/add-and-commit#771

fix: resolve absolute cwd without dumping the minified bundle (#495) by @EndBug in EndBug/add-and-commit#772

feat: treat pull: true as a default git pull by @EndBug in EndBug/add-and-commit#773

docs: add ross-spencer as a contributor for bug by @allcontributors[bot] in EndBug/add-and-commit#774

docs: add louisabraham as a contributor for ideas by @allcontributors[bot] in EndBug/add-and-commit#775

fix: reject --pathspec-from-file to prevent log disclosure by @EndBug in EndBug/add-and-commit#777

fix: neutralize workflow-command injection in info logs by @EndBug in EndBug/add-and-commit#776

fix: reject glued quotes that string-argv would split into extra git flags by @EndBug in EndBug/add-and-commit#778

chore(deps): bump js-yaml from 5.2.3 to 5.3.0 by @dependabot[bot] in EndBug/add-and-commit#780

chore(deps-dev): bump @vercel/ncc from 0.44.1 to 0.45.0 by @dependabot[bot] in EndBug/add-and-commit#779

Full Changelog: EndBug/add-and-commit@v11.0.0...v11.1.0

Commits

cc9c08b 11.1.1
3446398 fix: validate denylisted git args on every token (#784)
b0ca327 fix: Remove GH var interpolation in action.yml docstring (#783)
3e1240d docs: highlight untrusted git-arg interpolation as a warning callout (#781)
fc1cf1d 11.1.0
f14ee6d chore(deps-dev): bump @vercel/ncc from 0.44.1 to 0.45.0 (#779)
bccc19e chore(deps): bump js-yaml from 5.2.3 to 5.3.0 (#780)
7a6d750 ci: rebuild lib on Dependabot PRs so CI can re-run
66d71de fix: reject glued quotes that string-argv would split into extra git flags (#...
60ff4bb fix: neutralize workflow-command injection in info logs (#776)
Additional commits viewable in compare view

Updates pnpm/action-setup from 6.0.10 to 6.1.0

Release notes

Sourced from pnpm/action-setup's releases.

v6.1.0

What's Changed

feat: support pnpm v12 by @zkochan in pnpm/action-setup#288

Full Changelog: pnpm/action-setup@v6.0.10...v6.1.0

Commits

ea17c68 feat: support pnpm v12 (#288)
See full diff in compare view

Updates actions/setup-node from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Add support for mise.toml file by @gperdomor in actions/setup-node#1421

Support absolute paths in node-version-file by @v-mahabaleshwars in actions/setup-node#1633

Bug fixes:

Add Node version validation and manifest fetch retry by @v-jitenderpalsingh in actions/setup-node#1580

Documentation updates:

README.md: bump actions/checkout to latest version 7 by @deining in actions/setup-node#1578

docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by @v-gowridurgad in actions/setup-node#1593

Fixed cache recommendation syntax by @SubJunk in actions/setup-node#1603

Dependency updates:

Update workflow pins and migrate Node matrices to modern versions by @v-HarithaVattikuti in actions/setup-node#1583

Upgrade @actions/cache to 6.2.0 by @philip-gai in actions/setup-node#1584

Pin @types/node to v24 by @v-priyagupta108 in actions/setup-node#1585

Override brace-expansion to 5.0.8 by @v-priyagupta108 with @Copilot in actions/setup-node#1599

Upgrade actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-node#1598

Upgrade prettier from 3.8.4 to 3.9.6 by @dependabot in actions/setup-node#1590

Upgrade @vercel/ncc from 0.44.0 to 0.45.0 by @dependabot in actions/setup-node#1610

Upgrade pnpm/action-setup from 6.0.9 to 6.0.10 by @dependabot in actions/setup-node#1602

Upgrade baseline-browser-mapping from 2.10.38 to 2.11.22 by @dependabot in actions/setup-node#1629

Upgrade @types/semver from 7.7.1 to 7.8.0 by @dependabot in actions/setup-node#1616

Upgrade @typescript-eslint/parser from 8.62.0 to 8.70.0 by @dependabot in actions/setup-node#1615

Upgrade pnpm/action-setup from 6.0.10 to 6.1.0 by @dependabot in actions/setup-node#1631

Upgrade jest-each from 30.4.1 to 30.5.2 by @dependabot in actions/setup-node#1636

Upgrade eslint-plugin-n from 18.1.0 to 18.3.0 by @dependabot in actions/setup-node#1638

Update dependencies and add license files by @v-HarithaVattikuti in actions/setup-node#1642

Upgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by @dependabot in actions/setup-node#1635

New Contributors

@v-jitenderpalsingh made their first contribution in actions/setup-node#1580

@philip-gai made their first contribution in actions/setup-node#1584

@gperdomor made their first contribution in actions/setup-node#1421

@SubJunk made their first contribution in actions/setup-node#1603

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

Commits

949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
7207c4f chore: update dependencies and add license files (#1642)
54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
0c54c7b Bump @typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
a829419 Bump @types/semver from 7.7.1 to 7.8.0 (#1616)
680d1e4 Support absolute paths in node-version-file (#1633)
db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.

Updates @actions/artifact to v6.3.1.

New Contributors

@tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits

cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
c2acded chore: prepare v7.0.2 release
4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
8cbe1be Bump @actions/artifact to 6.3.1
See full diff in compare view

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

Update the readme by @danwkennedy in actions/download-artifact#473

Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.

Update @actions/artifact to 6.3.1 by @tunc-d in actions/download-artifact#492

Prepare download-artifact v8.0.2 by @tunc-d in actions/download-artifact#493

New Contributors

@tunc-d made their first contribution in actions/download-artifact#492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits

9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2

Bumps the github-actions group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [docker/build-push-action](https://github.com/docker/build-push-action) | `7.3.0` | `7.4.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.7` | `4.38.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.7` | `4.38.3` | | [mikefarah/yq](https://github.com/mikefarah/yq) | `4.53.3` | `4.54.1` | | [EndBug/add-and-commit](https://github.com/endbug/add-and-commit) | `11.0.0` | `11.1.1` | | [pnpm/action-setup](https://github.com/pnpm/action-setup) | `6.0.10` | `6.1.0` | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.2` | `3.0.3` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.2.0` | `4.4.1` | Updates `docker/build-push-action` from 7.3.0 to 7.4.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@53b7df9...c3c9e26) Updates `github/codeql-action/init` from 4.37.7 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@ff2f1c6...24c5418) Updates `github/codeql-action/analyze` from 4.37.7 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@ff2f1c6...24c5418) Updates `mikefarah/yq` from 4.53.3 to 4.54.1 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@1b9b4ac...504fc38) Updates `EndBug/add-and-commit` from 11.0.0 to 11.1.1 - [Release notes](https://github.com/endbug/add-and-commit/releases) - [Commits](EndBug/add-and-commit@645ecc0...cc9c08b) Updates `pnpm/action-setup` from 6.0.10 to 6.1.0 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@0977fd9...ea17c68) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@8207627...949feb2) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@043fb46...cf430e0) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@3e5f45b...9000827) Updates `softprops/action-gh-release` from 3.0.2 to 3.0.3 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@3d0d988...efb3536) Updates `docker/setup-buildx-action` from 4.2.0 to 4.4.1 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@bb05f3f...f87e599) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: mikefarah/yq dependency-version: 4.54.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: EndBug/add-and-commit dependency-version: 11.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: pnpm/action-setup dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: softprops/action-gh-release dependency-version: 3.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: docker/setup-buildx-action dependency-version: 4.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-10-12T14:01:35Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI
Review profile: CHILL
Plan: Advanced
Run ID: 823b8c4a-6bdb-4636-ba01-e22c53ee1efe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

argos-ci · 2026-10-12T14:11:50Z

The latest updates on your projects. Learn more about Argos notifications ↗︎

Build	Status	Details	Updated (UTC)
default (Inspect)	✅ No changes detected	-	Oct 12, 2026, 2:11 PM
e2e (Inspect)	✅ No changes detected	-	Oct 12, 2026, 2:19 PM

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 12, 2026

github-actions Bot added 💻 FW Lite issues related to the fw lite application, not miniLcm or crdt related 📦 Lexbox issues related to any server side code, fw-headless included 📙 Platform.Bible labels Oct 12, 2026

hahn-kev approved these changes Oct 14, 2026

View reviewed changes

hahn-kev merged commit 6abcb76 into develop Oct 14, 2026
41 checks passed

hahn-kev deleted the dependabot/github_actions/develop/github-actions-6eebe3a61e branch October 14, 2026 03:55

Navigation Menu

Repository navigation

Bump the github-actions group across 1 directory with 11 updates - #2749

Bump the github-actions group across 1 directory with 11 updates#2749
hahn-kev merged 1 commit into
developfrom
dependabot/github_actions/develop/github-actions-6eebe3a61e

dependabot Bot commented on behalf of github Oct 12, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 12, 2026

Review skipped

Uh oh!

argos-ci Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.4.0

v4.38.3

v4.38.2

v4.38.1

v4.38.0

v4.37.9

v4.37.8

CodeQL Action Changelog

[UNRELEASED]

4.38.3 - 08 Oct 2026

4.38.2 - 24 Sept 2026

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

4.37.9 - 26 Aug 2026

4.37.8 - 21 Aug 2026

4.37.7 - 13 Aug 2026

4.37.6 - 04 Aug 2026

4.37.5 - 03 Aug 2026

4.37.4 - 29 Jul 2026

v4.38.3

v4.38.2

v4.38.1

v4.38.0

v4.37.9

v4.37.8

CodeQL Action Changelog

[UNRELEASED]

4.38.3 - 08 Oct 2026

4.38.2 - 24 Sept 2026

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

4.37.9 - 26 Aug 2026

4.37.8 - 21 Aug 2026

4.37.7 - 13 Aug 2026

4.37.6 - 04 Aug 2026

4.37.5 - 03 Aug 2026

4.37.4 - 29 Jul 2026

v4.54.1 - if-then-else

v4.53.6

v4.53.4

v11.1.1

What's Changed

New Contributors

v11.1.0

What's Changed

v6.1.0

What's Changed

v7.1.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

v7.0.2

What's Changed

New Contributors

v8.0.2

What's Changed

New Contributors

Uh oh!

coderabbitai Bot commented Oct 12, 2026

Review skipped

Uh oh!

argos-ci Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 12, 2026 •

edited

Loading

argos-ci Bot commented Oct 12, 2026 •

edited

Loading