chore(deps): bump the actions-all group across 1 directory with 8 updates by dependabot[bot] · Pull Request #1815 · jmrplens/gitlab-mcp-server

dependabot · 2026-11-12T08:48:49Z

Bumps the actions-all group with 8 updates in the / directory:

Package	From	To
SonarSource/sonarqube-scan-action	`8.4.0`	`8.4.1`
pnpm/action-setup	`6.1.0`	`6.1.1`
github/codeql-action/init	`4.39.1`	`4.39.3`
github/codeql-action/analyze	`4.39.1`	`4.39.3`
sigstore/cosign-installer	`4.1.2`	`4.1.3`
docker/login-action	`4.7.0`	`4.8.0`
actions/setup-dotnet	`6.0.0`	`6.1.0`
github/codeql-action/upload-sarif	`4.39.1`	`4.39.3`

Updates SonarSource/sonarqube-scan-action from 8.4.0 to 8.4.1

Release notes

Sourced from SonarSource/sonarqube-scan-action's releases.

v8.4.1

What's Changed

Update dependency node to v26 by @renovate[bot] in SonarSource/sonarqube-scan-action#294

SQSCANGHA-184 Bump undici from 6.28.1 to 6.29.1 by @dependabot[bot] in SonarSource/sonarqube-scan-action#289

SQSCANGHA-191 Bump scanner-cli version to 8.3.1.16491 by @jerome-chetelat-sonarsource in SonarSource/sonarqube-scan-action#298

New Contributors

@jerome-chetelat-sonarsource made their first contribution in SonarSource/sonarqube-scan-action#298

Full Changelog: SonarSource/sonarqube-scan-action@v8.4.0...v8.4.1

Commits

e805d87 SQSCANGHA-191 Bump scanner-cli version to 8.3.1.16491 (#298)
5e62cf2 SQSCANGHA-189 docs: remove duplicate README logo (#295)
afe7ea1 SQSCANGHA-184 Bump undici from 6.28.1 to 6.29.1 (#289)
d86a3b3 Update dependency node to v26 (#294)
8a538b9 Run build and build-wrapper compatibility checks every weekday (#292)
See full diff in compare view

Updates pnpm/action-setup from 6.1.0 to 6.1.1

Release notes

Sourced from pnpm/action-setup's releases.

v6.1.1

What's Changed

fix: refresh native bootstrap and test shared store reuse by @zkochan in pnpm/action-setup#293

fix: update pnpm 11 bootstrap to 11.28.10 by @rstacruz25 in pnpm/action-setup#292

chore: update pinned GitHub Actions by @deining in pnpm/action-setup#223

fix: skip saving missing cache directories by @zkochan in pnpm/action-setup#294

docs: clarify manifest-based version selection by @djmurphy32 in pnpm/action-setup#244

New Contributors

@rstacruz25 made their first contribution in pnpm/action-setup#292

@djmurphy32 made their first contribution in pnpm/action-setup#244

Full Changelog: pnpm/action-setup@v6.1.0...v6.1.1

Commits

73e4699 docs: clarify manifest-based version selection (#244)
c05d46d fix: skip saving missing cache directories (#294)
343d2b1 Bump GitHub action workflows (#223)
9a15f15 fix: update pnpm 11 bootstrap to 11.28.10 (#292)
7cf8c4c fix: refresh native bootstrap and test shared store reuse (#293)
See full diff in compare view

Updates github/codeql-action/init from 4.39.1 to 4.39.3

Release notes

Sourced from github/codeql-action/init's releases.

v4.39.3

Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

v4.39.2

Update default CodeQL bundle version to 2.27.4. #4284

Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266

Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.3 - 04 Nov 2026

Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

4.39.2 - 03 Nov 2026

Update default CodeQL bundle version to 2.27.4. #4284

Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266

Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

4.39.1 - 21 Oct 2026

Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148

Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206

The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

... (truncated)

Commits

33d7b85 Merge pull request #4299 from github/update-v4.39.3-064910ba2
24393f8 Update changelog for v4.39.3
064910b Merge pull request #4297 from github/mbg/update-glob
f532ac5 Update glob to 14.0.3
8cd4dfa Merge pull request #4280 from github/mbg/ci/validate-yaml
cea289b Return different exit code when a language is not recognised
7287bb3 Remove exclude entry that's no longer needed
8eb7cdf Use normal .editorconfig pattern
160e547 Merge remote-tracking branch 'origin/main' into mbg/ci/validate-yaml
913e1bb Merge pull request #4283 from github/sam-robson/decode-diff-informed-sarif-uris
Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.39.1 to 4.39.3

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.39.3

Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

v4.39.2

Update default CodeQL bundle version to 2.27.4. #4284

Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266

Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.3 - 04 Nov 2026

Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

4.39.2 - 03 Nov 2026

Update default CodeQL bundle version to 2.27.4. #4284

Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266

Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

4.39.1 - 21 Oct 2026

Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148

Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206

The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

... (truncated)

Commits

33d7b85 Merge pull request #4299 from github/update-v4.39.3-064910ba2
24393f8 Update changelog for v4.39.3
064910b Merge pull request #4297 from github/mbg/update-glob
f532ac5 Update glob to 14.0.3
8cd4dfa Merge pull request #4280 from github/mbg/ci/validate-yaml
cea289b Return different exit code when a language is not recognised
7287bb3 Remove exclude entry that's no longer needed
8eb7cdf Use normal .editorconfig pattern
160e547 Merge remote-tracking branch 'origin/main' into mbg/ci/validate-yaml
913e1bb Merge pull request #4283 from github/sam-robson/decode-diff-informed-sarif-uris
Additional commits viewable in compare view

Updates sigstore/cosign-installer from 4.1.2 to 4.1.3

Release notes

Sourced from sigstore/cosign-installer's releases.

v4.1.3

What's Changed

Bump Cosign to v3.1.4 (latest release) in sigstore/cosign-installer#257

Full Changelog: sigstore/cosign-installer@v4.1.2...v4.1.3

Commits

756fe2d Bump Cosign to v3.1.4 (latest release) (#257)
b9c3539 Bump actions/setup-go from 6.4.0 to 7.0.0 (#249)
84205a0 close race on windows due to reusing filename (#253)
af595e6 Bump cosign to 3.1.3 (#252)
828df1e fix: harden curl download retries against transient GitHub CDN 504s (#240)
874852d Bump actions/checkout from 6.0.2 to 7.0.1 (#250)
3094a48 wrap path in quotes for powershell (#246)
e246ae3 test minimum of 1.26 given cosign requirement (#247)
See full diff in compare view

Updates docker/login-action from 4.7.0 to 4.8.0

Release notes

Sourced from docker/login-action's releases.

v4.8.0

Set Docker Hub OIDC token lifetime default to 1 hour by @crazy-max in docker/login-action#1070

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1161.0 in docker/login-action#1103

Bump @docker/actions-toolkit from 0.107.0 to 0.109.0 in docker/login-action#1105

Bump vite from 7.3.6 to 7.3.7 in docker/login-action#1101

Full Changelog: docker/login-action@v4.7.0...v4.8.0

Commits

8aa5831 Merge pull request #1105 from docker/dependabot/npm_and_yarn/docker/actions-t...
043f81d [dependabot skip] chore: update generated content
3ff6998 build(deps): bump @docker/actions-toolkit from 0.107.0 to 0.109.0
694ef6a Merge pull request #1103 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
7c6e412 [dependabot skip] chore: update generated content
aa2441f build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
d6c10b0 Merge pull request #1106 from docker/dependabot/github_actions/codeql-actions...
319f1ee Merge pull request #1104 from docker/dependabot/github_actions/actions/setup-...
b483b7f Merge pull request #1101 from docker/dependabot/npm_and_yarn/vite-7.3.7
dc7d67c Merge pull request #1070 from crazy-max/increase-oidc-default-expiry
Additional commits viewable in compare view

Updates actions/setup-dotnet from 6.0.0 to 6.1.0

Release notes

Sourced from actions/setup-dotnet's releases.

v6.1.0

What's Changed

Enhancements

Add check-latest input to reuse a locally installed .NET SDK and skip network calls by @v-mahabaleshwars in actions/setup-dotnet#774

Add skip-lts-prepass input to optimize .NET SDK installation process by @v-chiranjib-swain in actions/setup-dotnet#791

Add fallback install directory when default is not writable by @v-priyagupta108 in actions/setup-dotnet#785

Documentation

Document sdk.version validation for rollForward in global.json by @v-priyagupta108 in actions/setup-dotnet#763

Docs: Add Microsoft docs link for dotnet-quality options by @v-priyagupta108 in actions/setup-dotnet#773

Docs: Updating Documentation in README by @v-lmvysakh in actions/setup-dotnet#776

Clarify dotnet-quality behavior for multiple SDK versions by @v-mahabaleshwars in actions/setup-dotnet#780

Dependency Updates

Fix security vulnerabilities by @v-HarithaVattikuti in actions/setup-dotnet#767

ci: make validation caches read-only by @philip-gai in actions/setup-dotnet#777

Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-dotnet#764

Bump browserslist from 4.28.2 to 4.28.8 by @dependabot in actions/setup-dotnet#781

Bump eslint from 10.5.0 to 10.11.0 by @dependabot in actions/setup-dotnet#772

Bump eslint-plugin-jest from 29.15.2 to 29.16.6 by @dependabot in actions/setup-dotnet#771

Bump undici from 6.28.0 to 6.29.1 by @dependabot in actions/setup-dotnet#784

Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-dotnet#788

Bump handlebars from 4.7.9 to 4.7.10 by @dependabot in actions/setup-dotnet#792

Bump brace-expansion by @dependabot in actions/setup-dotnet#790

Prepare v6.1.0 release with updated cache dependency by @v-HarithaVattikuti in actions/setup-dotnet#798

New Contributors

@v-lmvysakh made their first contribution in actions/setup-dotnet#776

@v-chiranjib-swain made their first contribution in actions/setup-dotnet#791

Full Changelog: actions/setup-dotnet@v6.0.0...v6.1.0

Commits

0f4a354 Prepare v6.1.0 release with updated cache dependency (#798)
6ec5c6b Add fallback install directory when default is not writable (#785)
62573f4 Bump brace-expansion (#790)
67290a9 Bump handlebars from 4.7.9 to 4.7.10 (#792)
0072421 Bump actions/checkout from 7.0.0 to 7.0.1 (#788)
9ead317 Bump undici from 6.28.0 to 6.29.1 (#784)
349aa19 Add skip-lts-prepass input to optimize .NET SDK installation process (#791)
e2cf7c6 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#771)
7576362 Bump eslint from 10.5.0 to 10.11.0 (#772)
074373f Add check-latest input to reuse a locally installed .NET SDK and skip network...
Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.39.1 to 4.39.3

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.39.3

Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

v4.39.2

Update default CodeQL bundle version to 2.27.4. #4284

Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266

Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.3 - 04 Nov 2026

Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

4.39.2 - 03 Nov 2026

Update default CodeQL bundle version to 2.27.4. #4284

Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266

Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

4.39.1 - 21 Oct 2026

Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148

Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206

The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

... (truncated)

Commits

33d7b85 Merge pull request #4299 from github/update-v4.39.3-064910ba2
24393f8 Update changelog for v4.39.3
064910b Merge pull request #4297 from github/mbg/update-glob
f532ac5 Update glob to 14.0.3
8cd4dfa Merge pull request #4280 from github/mbg/ci/validate-yaml
cea289b Return different exit code when a language is not recognised
7287bb3 Remove exclude entry that's no longer needed
8eb7cdf Use normal .editorconfig pattern
160e547 Merge remote-tracking branch 'origin/main' into mbg/ci/validate-yaml
913e1bb Merge pull request #4283 from github/sam-robson/decode-diff-informed-sarif-uris
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ates Bumps the actions-all group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action) | `8.4.0` | `8.4.1` | | [pnpm/action-setup](https://github.com/pnpm/action-setup) | `6.1.0` | `6.1.1` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.39.1` | `4.39.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.39.1` | `4.39.3` | | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `4.1.2` | `4.1.3` | | [docker/login-action](https://github.com/docker/login-action) | `4.7.0` | `4.8.0` | | [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `6.0.0` | `6.1.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.39.1` | `4.39.3` | Updates `SonarSource/sonarqube-scan-action` from 8.4.0 to 8.4.1 - [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases) - [Commits](SonarSource/sonarqube-scan-action@4d1dc0c...e805d87) Updates `pnpm/action-setup` from 6.1.0 to 6.1.1 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@ea17c68...73e4699) Updates `github/codeql-action/init` from 4.39.1 to 4.39.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@9b32540...33d7b85) Updates `github/codeql-action/analyze` from 4.39.1 to 4.39.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@9b32540...33d7b85) Updates `sigstore/cosign-installer` from 4.1.2 to 4.1.3 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@6f9f177...756fe2d) Updates `docker/login-action` from 4.7.0 to 4.8.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@81c6f93...8aa5831) Updates `actions/setup-dotnet` from 6.0.0 to 6.1.0 - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@a98b568...0f4a354) Updates `github/codeql-action/upload-sarif` from 4.39.1 to 4.39.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@9b32540...33d7b85) --- updated-dependencies: - dependency-name: SonarSource/sonarqube-scan-action dependency-version: 8.4.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-all - dependency-name: pnpm/action-setup dependency-version: 6.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-all - dependency-name: github/codeql-action/init dependency-version: 4.39.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-all - dependency-name: github/codeql-action/analyze dependency-version: 4.39.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-all - dependency-name: sigstore/cosign-installer dependency-version: 4.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-all - dependency-name: docker/login-action dependency-version: 4.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-all - dependency-name: actions/setup-dotnet dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-all - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-all ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot requested a review from jmrplens as a code owner November 12, 2026 08:48

dependabot Bot added dependencies Pull requests that update a dependency file github-actions Dependabot: a GitHub Actions update labels Nov 12, 2026

github-actions Bot added security Security-related issue ci Build pipeline, workflows, or lint configuration distribution Release artifacts, packaging, and install channels site The documentation site's build, components and scripts, not its content labels Nov 12, 2026

Navigation Menu

Repository navigation

chore(deps): bump the actions-all group across 1 directory with 8 updates - #1815

chore(deps): bump the actions-all group across 1 directory with 8 updates#1815
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-all-f59f1c89b2

dependabot Bot commented on behalf of github Nov 12, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 12, 2026

v8.4.1

What's Changed

New Contributors

v6.1.1

What's Changed

New Contributors

v4.39.3

v4.39.2

CodeQL Action Changelog

[UNRELEASED]

4.39.3 - 04 Nov 2026

4.39.2 - 03 Nov 2026

4.39.1 - 21 Oct 2026

4.39.0 - 15 Oct 2026

4.38.3 - 08 Oct 2026

4.38.2 - 24 Sept 2026

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

v4.39.3

v4.39.2

CodeQL Action Changelog

[UNRELEASED]

4.39.3 - 04 Nov 2026

4.39.2 - 03 Nov 2026

4.39.1 - 21 Oct 2026

4.39.0 - 15 Oct 2026

4.38.3 - 08 Oct 2026

4.38.2 - 24 Sept 2026

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

v4.1.3

What's Changed

v4.8.0

v6.1.0

What's Changed

Enhancements

Documentation

Dependency Updates

New Contributors

v4.39.3

v4.39.2

CodeQL Action Changelog

[UNRELEASED]

4.39.3 - 04 Nov 2026

4.39.2 - 03 Nov 2026

4.39.1 - 21 Oct 2026

4.39.0 - 15 Oct 2026

4.38.3 - 08 Oct 2026

4.38.2 - 24 Sept 2026

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants