Skip to content

chore(deps): update github actions - #1190

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions
Open

chore(deps): update github actions#1190
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions

Conversation

@renovate

@renovate renovate Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
actions/download-artifact action patch v8.0.1 → v8.0.2
anchore/sbom-action action patch v0.24.2 → v0.24.3
github/codeql-action action minor v4.38.2 → v4.39.3
step-security/harden-runner action minor v2.21.1 → v2.22.4
zizmorcore/zizmor-action action minor v0.6.4 → v0.8.1

Release Notes

actions/download-artifact

v8.0.2

Compare Source

What's Changed
New Contributors

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

anchore/sbom-action

v0.24.3

Compare Source

Added Features
Bug Fixes

(Full Changelog)

github/codeql-action

v4.39.3

Compare Source

  • Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #​4283

v4.39.2

Compare Source

  • Update default CodeQL bundle version to 2.27.4. #​4284
  • Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4266
  • Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #​4221
  • The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #​4243

v4.39.1

Compare Source

v4.39.0

Compare Source

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #​4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #​4198

v4.38.3

Compare Source

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4188
  • Update default CodeQL bundle version to 2.27.2. #​4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #​4184
step-security/harden-runner

v2.22.4

Compare Source

What's Changed
  • Fixed a Linux agent memory leak that could cause runners to run out of memory during jobs with heavy process or network activity.
  • The workaround for GitHub’s DNS resolver and outbound proxy experiment on GitHub-hosted Linux runners now defaults to enabled when feature flags can’t be fetched.
  • Improved HTTP/2 TLS interception on Linux (enterprise tier).
  • Added retries for failed monitoring API requests, improving reliability of monitoring initialization and raw-event uploads.

Full Changelog: step-security/harden-runner@v2.22.3...v2.22.4

v2.22.3

Compare Source

What's Changed
  • Added support for Avrea-hosted runners (enterprise tier)
  • Fixed unexpected blocking of allowed connections caused by GitHub’s DNS resolver and outbound proxy experiment on GitHub-hosted Linux runners
  • Added a feature flag to disable implicit AWS endpoint allowances on self-hosted Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.22.2...v2.22.3

v2.22.2

Compare Source

What's Changed
  • Fixed inbound (ingress) network traffic being incorrectly classified as outbound (egress) traffic on macOS
  • Fixed implicit endpoints intended for self-hosted runners being applied to custom VM environments on Linux (enterprise tier)
  • Improved network and DNS tracing, enforcement logic, and process information correlation on Linux (enterprise tier)

Full Changelog: step-security/harden-runner@v2.22.1...v2.22.2

v2.22.1

Compare Source

What's Changed
  • Fixed security rules not initializing on GHES self-hosted runners
  • Fixed GHES connectivity in block mode by implicitly allowing the GHES hostname

Full Changelog: step-security/harden-runner@v2.22.0...v2.22.1

v2.22.0

Compare Source

What's Changed
  • Linux ARM64 support for community tier
  • GHES support for self-hosted VMs (enterprise tier)
  • MacOS and Windows runner deny list support for block policy (enterprise tier).

Full Changelog: step-security/harden-runner@v2.21.1...v2.22.0

zizmorcore/zizmor-action

v0.8.1

Compare Source

Sponsorship is appreciated!

zizmor 1.32 is now the default version used by this action.

Full release notes: https://docs.zizmor.sh/release-notes/#​1320

Full Changelog: zizmorcore/zizmor-action@v0.8.0...v0.8.1

v0.8.0

Compare Source

The action now supports prereleases.

The default has not changed, but you can pass a prerelease version
of zizmor or version: prerelease to get whatever latest
prerelease the action knows about.

What's Changed

Full Changelog: zizmorcore/zizmor-action@v0.7.1...v0.8.0

v0.7.1

Compare Source

zizmor changes

Bug Fixes 🐛🔗

  • Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Compare Source

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

  • The typosquat-uses audit now supports pre-commit config inputs (#​2437)

  • The self-hosted-runner audit is now significantly more precise (#​2350)

    Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

  • The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#​2396)

  • zizmor is now aware of the image_version workflow trigger (#​2397)

  • The dangerous-triggers audit now produces more precise finding/diagnostic spans (#​2402)

  • The cache-poisoning audit is now aware of pnpm/setup (#​2409)

  • The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#​2395)

    Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

  • The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#​2418)

  • The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#​2426)

  • zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#​2444)

Bug Fixes 🐛🔗

  • Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#​2386)

    Many thanks to @​marcalexiei for implementing this improvement!

  • Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#​2390)

  • Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#​2394)

  • Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#​2413)

  • Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#​2444)

action notes

What's Changed

New Contributors

Full Changelog: zizmorcore/zizmor-action@v0.6.4...v0.7.0

Configuration

📅 Schedule: (in timezone Europe/London)

  • Branch creation
    • "before 6am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Oct 12, 2026
@codecov

codecov Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown

❌ 1 Tests Failed:

Tests completed Failed Passed Skipped
2160 1 2159 24
View the top 1 failed test(s) by shortest run time 
test::recovery workflow runs on protected main and downloads exact original run artifacts without rebuilding
Stack Traces | 0.00191s run time 
[Error [ERR_TEST_FAILURE]: Expected values to be strictly equal:

0 !== 2
] {
  code: 'ERR_TEST_FAILURE',
  failureType: 'testCodeFailure',
  cause: AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
  
  0 !== 2
  
      at TestContext.<anonymous> (file:.../nowplaying/test/release-recovery.test.js:96:10)
      at Test.runInAsyncScope (node:async_hooks:214:14)
      at Test.run (node:internal/test_runner/test:1047:25)
      at Test.processPendingSubtests (node:internal/test_runner/test:744:18)
      at Test.postRun (node:internal/test_runner/test:1173:19)
      at Test.run (node:internal/test_runner/test:1101:12)
      at async Test.processPendingSubtests (node:internal/test_runner/test:744:7) {
    generatedMessage: true,
    code: 'ERR_ASSERTION',
    actual: 0,
    expected: 2,
    operator: 'strictEqual',
    diff: 'simple'
  }
}

To view more test analytics, go to the Test Analytics Dashboard
📋 Got 3 mins? Take this short survey to help us improve Test Analytics.

@renovate
renovate Bot force-pushed the renovate/github-actions branch 5 times, most recently from 15dde67 to c6b0711 Compare October 19, 2026 00:29
@renovate
renovate Bot force-pushed the renovate/github-actions branch 5 times, most recently from 745bf2e to cb36ba7 Compare October 26, 2026 11:12
@renovate
renovate Bot force-pushed the renovate/github-actions branch 3 times, most recently from 3d69655 to 6fc738b Compare November 6, 2026 16:41
@renovate
renovate Bot force-pushed the renovate/github-actions branch from 6fc738b to 67b00d0 Compare November 7, 2026 17:25
@renovate
renovate Bot force-pushed the renovate/github-actions branch from 67b00d0 to 177f6cf Compare November 9, 2026 22:40

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area:ci area:release area:security dependencies Pull requests that update a dependency file size:S

Projects

nowplaying
Status: Backlog

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants