chore(deps): bump the actions group across 1 directory with 8 updates by dependabot[bot] · Pull Request #704 · hyperpolymath/hypatia

dependabot · 2026-08-17T21:18:43Z

Bumps the actions group with 8 updates in the / directory:

Package	From	To
taiki-e/install-action	`2.85.3`	`2.85.13`
Swatinem/rust-cache	`2.9.1`	`2.9.2`
haskell-actions/setup	`2.11.0`	`2.12.0`
github/codeql-action	`4.37.3`	`4.37.7`
docker/login-action	`4.5.2`	`4.6.0`
actions/attest-build-provenance	`4.1.1`	`4.2.2`
trufflesecurity/trufflehog	`3.96.0`	`3.97.0`
actions/setup-java	`5.6.0`	`5.7.0`

Updates taiki-e/install-action from 2.85.3 to 2.85.13

Release notes

Sourced from taiki-e/install-action's releases.

2.85.13

Update tombi@latest to 1.3.3.

Update mise@latest to 2026.8.5.

Update kingfisher@latest to 1.113.0.

Update cargo-shear@latest to 1.13.4.

Update bpf-linker@latest to 0.11.0.

2.85.12

Update zola@latest to 0.23.3.

Update wasm-tools@latest to 1.256.0.

Update tombi@latest to 1.2.10.

Update syft@latest to 1.51.0.

Update prek@latest to 0.4.13.

Update mise@latest to 2026.8.4.

Update editorconfig-checker@latest to 3.11.1.

Update cargo-tarpaulin@latest to 0.37.1.

Update cargo-rdme@latest to 2.2.1.

Update biome@latest to 2.5.8.

2.85.11

Update zola@latest to 0.23.2.

Update wasm-bindgen@latest to 0.2.127.

Update uv@latest to 0.12.3.

Update osv-scanner@latest to 2.5.0.

Update mise@latest to 2026.8.3.

Update kingfisher@latest to 1.112.0.

Update editorconfig-checker@latest to 3.10.0.

2.85.10

Update uv@latest to 0.12.2.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

[2.85.13] - 2026-08-13

Update tombi@latest to 1.3.3.

Update mise@latest to 2026.8.5.

Update kingfisher@latest to 1.113.0.

Update cargo-shear@latest to 1.13.4.

Update bpf-linker@latest to 0.11.0.

[2.85.12] - 2026-08-12

Update zola@latest to 0.23.3.

Update wasm-tools@latest to 1.256.0.

Update tombi@latest to 1.2.10.

Update syft@latest to 1.51.0.

Update prek@latest to 0.4.13.

Update mise@latest to 2026.8.4.

Update editorconfig-checker@latest to 3.11.1.

Update cargo-tarpaulin@latest to 0.37.1.

Update cargo-rdme@latest to 2.2.1.

Update biome@latest to 2.5.8.

[2.85.11] - 2026-08-09

Update zola@latest to 0.23.2.

Update wasm-bindgen@latest to 0.2.127.

Update uv@latest to 0.12.3.

Update osv-scanner@latest to 2.5.0.

Update mise@latest to 2026.8.3.

Update kingfisher@latest to 1.112.0.

Update editorconfig-checker@latest to 3.10.0.

... (truncated)

Commits

82cd3e7 Release 2.85.13
4dd6c67 Update tombi@latest to 1.3.3
91cb1bb Update mise@latest to 2026.8.5
83d968e Update kingfisher@latest to 1.113.0
f7ab7f5 Update cargo-xwin manifest
3faddd9 Update cargo-shear@latest to 1.13.4
b4cb4b2 Update bpf-linker@latest to 0.11.0
b20dedc Release 2.85.12
952d13c ci: Skip cargo-rdme on x86_64 macOS
c8724e7 Update zola@latest to 0.23.3
Additional commits viewable in compare view

Updates Swatinem/rust-cache from 2.9.1 to 2.9.2

Release notes

Sourced from Swatinem/rust-cache's releases.

v2.9.2

What's Changed

Typofix by @23Skidoo in Swatinem/rust-cache#316

fix: include target names in build/ and .fingerprint/ cleanup by @eitsupi in Swatinem/rust-cache#317

fix: include cdylib/rlib/dylib/staticlib targets in build and fingerprint cleanup by @eitsupi in Swatinem/rust-cache#320

Scan content of $CARGO_HOME/bin on restore instead of relying on cargo install metadata by @clechasseur in Swatinem/rust-cache#325

docs: Update checkout action version to latest by @sondrelg in Swatinem/rust-cache#345

Fix Windows cache path validation after Rollup migration by @eitsupi in Swatinem/rust-cache#355

fix: support Cargo V2 build dir layout by @claytonwramsey in Swatinem/rust-cache#371

New Contributors

@23Skidoo made their first contribution in Swatinem/rust-cache#316

@eitsupi made their first contribution in Swatinem/rust-cache#317

@clechasseur made their first contribution in Swatinem/rust-cache#325

@sondrelg made their first contribution in Swatinem/rust-cache#345

@claytonwramsey made their first contribution in Swatinem/rust-cache#371

Full Changelog: Swatinem/rust-cache@v2.9.1...v2.9.2

Changelog

Sourced from Swatinem/rust-cache's changelog.

2.9.2

Fix credentials.toml cleanup

Improvements to cleanup, preserving more valid targets

Improvements to cargo install handling

Correctly sort/dedupe Rust versions

Commits

6323deb 2.9.2
b16e8d7 bump rollup and rebuild
3bf42ac invert target/profile check in cleanup
6e5b278 correctly sort and dedupe Rust versions
5adc05f Bump the actions group across 1 directory with 3 updates (#368)
66b1e95 fix: support Cargo V2 build dir layout (#371)
72d126e Merge pull request #367 from Swatinem/dependabot/npm_and_yarn/dev-patch-2b495...
48968d2 Bump the dev-patch group with 2 updates
9f151ac update dependencies, rebuild
0e24e5d Bump the actions group across 1 directory with 6 updates (#364)
Additional commits viewable in compare view

Updates haskell-actions/setup from 2.11.0 to 2.12.0

Commits

6037f33 fix: parseYAMLBoolean for enable-stack/stack-no-global/stack-setup-ghc/disabl...
d07e232 fix: bump bundled ghcup from 0.1.50.2 to 0.2.6.2
5873697 Bump actions/setup-node from 6 to 7
482af4f Bump actions/checkout from 6 to 7
See full diff in compare view

Updates github/codeql-action from 4.37.3 to 4.37.7

Release notes

Sourced from github/codeql-action's releases.

v4.37.7

Update default CodeQL bundle version to 2.26.3. #4085

v4.37.6

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

v4.37.4

This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037

Update default CodeQL bundle version to 2.26.2. #4051

Changelog

Sourced from github/codeql-action's changelog.

4.37.7 - 13 Aug 2026

Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037

Update default CodeQL bundle version to 2.26.2. #4051

Commits

ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
951a133 Update changelog for v4.37.7
be7a3db Merge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...
9310334 Merge pull request #4086 from github/mbg/thread-action-state-to-codeql
b4d8a54 Rebuild
ab5db25 Bump the npm-minor group across 1 directory with 8 updates
38055a3 Drop logger from databaseInitCluster in interface
1f87aed Merge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3
dc1b98a Make logger available to getCodeQLForCmd
6f0220e Merge pull request #4084 from github/navntoft/bump-undici
Additional commits viewable in compare view

Updates docker/login-action from 4.5.2 to 4.6.0

Release notes

Sourced from docker/login-action's releases.

v4.6.0

Harden buildx scoped config path handling by @crazy-max in docker/login-action#1059

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1095.0 in docker/login-action#1051

Bump js-yaml from 5.2.1 to 5.2.2 in docker/login-action#1057

Bump postcss from 8.5.10 to 8.5.22 in docker/login-action#1056

Full Changelog: docker/login-action@v4.5.2...v4.6.0

Commits

dbcb813 Merge pull request #1051 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
5bcb015 [dependabot skip] chore: update generated content
b30b2f2 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
9087f1e Merge pull request #1057 from docker/dependabot/npm_and_yarn/js-yaml-5.2.2
0009830 [dependabot skip] chore: update generated content
2325523 build(deps): bump js-yaml from 5.2.1 to 5.2.2
4ec1d4a Merge pull request #1056 from docker/dependabot/npm_and_yarn/postcss-8.5.22
5fc99ba Merge pull request #1053 from docker/dependabot/github_actions/aws-actions/co...
e512bd5 Merge pull request #1052 from docker/dependabot/github_actions/codeql-actions...
a146c91 Merge pull request #1059 from crazy-max/harden-buildx-scope-paths
Additional commits viewable in compare view

Updates actions/attest-build-provenance from 4.1.1 to 4.2.2

Release notes

Sourced from actions/attest-build-provenance's releases.

v4.2.2

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group by @dependabot[bot] in actions/attest-build-provenance#862

Full Changelog: actions/attest-build-provenance@v4.1.1...v4.2.2

Commits

4d10147 Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group (#862)
e3fe62e Bump the actions-minor group with 2 updates (#860)
See full diff in compare view

Updates trufflesecurity/trufflehog from 3.96.0 to 3.97.0

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.97.0

What's Changed

fix(detectors/privatekey): report encrypted keys with uncrackable passphrases by @genisis0x in trufflesecurity/trufflehog#5127

Update module go.mongodb.org/mongo-driver to v1.17.7 [SECURITY] by @renovate[bot] in trufflesecurity/trufflehog#5058

Remove url tag from common HTTP client metrics by @mcastorina in trufflesecurity/trufflehog#5158

Update github.com/avast/apkparser digest to 7fcaee4 by @renovate[bot] in trufflesecurity/trufflehog#5037

[INS-318] Add New Relic License Key Detector by @mustansir14 in trufflesecurity/trufflehog#4760

[INS-348] Add New Relic Browser Key detector by @mustansir14 in trufflesecurity/trufflehog#4769

[INS-339] Add New Relic User Key detector by @mustansir14 in trufflesecurity/trufflehog#4794

[INS-345] Add New Relic Insights Query Key detector by @mustansir14 in trufflesecurity/trufflehog#4781

fix(sources): stop UnitHook Close racing in-flight Finish sends by @bill-rich in trufflesecurity/trufflehog#5154

There are now 3 CircleCI projects by @trufflesteeeve in trufflesecurity/trufflehog#5166

Update github.com/shurcooL/githubv4 digest to 2402fdf by @renovate[bot] in trufflesecurity/trufflehog#5038

Update github-actions by @renovate[bot] in trufflesecurity/trufflehog#5036

Update aws-sdk-go-v2 monorepo by @renovate[bot] in trufflesecurity/trufflehog#4890

[INS-344] Add New Relic Mobile App Token Detector by @mustansir14 in trufflesecurity/trufflehog#4810

Give each clone its own directory under --clone-path by @shahzadhaider1 in trufflesecurity/trufflehog#5175

feat(output): add SARIF output format for GitHub code scanning by @kashifkhan0771 in trufflesecurity/trufflehog#5165

[SCAN-1018] Treat SlackWebhook invalid_token (HTTP 400) as determinate not-live by @alafiand in trufflesecurity/trufflehog#5177

make cwd-changing normalization tests non-parallel to fix flaky clone failures by @jordanTunstill in trufflesecurity/trufflehog#5178

[INS-456] Add Microsoft Teams Webhook V2 detector by @mustansir14 in trufflesecurity/trufflehog#4902

surface git clone errors at v(0) by @jordanTunstill in trufflesecurity/trufflehog#5162

Add Figma Personal Access Token v3 Detector by @shahzadhaider1 in trufflesecurity/trufflehog#4790

fix(github): fallback resource Name to avoid empty-string proto validation failure by @kashifkhan0771 in trufflesecurity/trufflehog#5182

[INT-643] Update Protos definition to cater bitbucket Api token authentication by @MuneebUllahKhan222 in trufflesecurity/trufflehog#5171

Update regex pattern and 403 handling in the Lob detector to fix false positives by @MachiavelliII in trufflesecurity/trufflehog#5188

Deprecate AppOptics detector by @Ahsan-Sarbaz in trufflesecurity/trufflehog#5198

Anthropic detector: surface API error detail on non-2xx verification by @Ahsan-Sarbaz in trufflesecurity/trufflehog#5180

Deprecated bingsubscriptionkey detector by @Ahsan-Sarbaz in trufflesecurity/trufflehog#5179

Add SolarWinds Observability detector by @Ahsan-Sarbaz in trufflesecurity/trufflehog#5199

fix(jiratoken): stop 202 reverification retry loop by @Ahsan-Sarbaz in trufflesecurity/trufflehog#5200

Add custom endpoint support to the S3 source by @shahzadhaider1 in trufflesecurity/trufflehog#5202

fix(blogger): anchor regex to AIzaSy prefix to eliminate false positives by @unsmith in trufflesecurity/trufflehog#5203

fix(huggingface): move unscoped fine-grained models to UnboundedResources by @unsmith in trufflesecurity/trufflehog#5204

Add AWS Secrets Manager metadata type by @rosecodym in trufflesecurity/trufflehog#5210

fix(detectors/harness): allow underscore in PAT account segment by @mattbrady-1 in trufflesecurity/trufflehog#5153

New Contributors

@MachiavelliII made their first contribution in trufflesecurity/trufflehog#5188

@Ahsan-Sarbaz made their first contribution in trufflesecurity/trufflehog#5198

@unsmith made their first contribution in trufflesecurity/trufflehog#5203

Full Changelog: trufflesecurity/trufflehog@v3.96.0...v3.97.0

Commits

bcfcf73 fix(detectors/harness): allow underscore in PAT account segment (#5153)
f567838 Add AWS Secrets Manager metadata type (#5210)
ee476c7 update huggingface to fix unbounded resources bug (#5204)
37ed218 fix blogger detector to use Google API prefix instead of generic hex string (...
55db46b Add custom endpoint support to the S3 source (#5202)
96b593f fix(jiratoken): stop 202 reverification retry loop (#5200)
f9daad8 Add SolarWinds Observability detector (#5199)
8b5a47c Deprecated bingsubscriptionkey detector (#5179)
3539500 Anthropic detector: surface API error detail on non-2xx verification (#5180)
58cb799 Deprecate AppOptics detector (#5198)
Additional commits viewable in compare view

Updates actions/setup-java from 5.6.0 to 5.7.0

Release notes

Sourced from actions/setup-java's releases.

v5.7.0

What's Changed

Fix npm audit failures on releases/v5 by @brunoborges in actions/setup-java#1154

Backport #1151: Fix missing wrapper cache distributions by @brunoborges in actions/setup-java#1153

Deprecate legacy Adopt distributions in v5 by @brunoborges in actions/setup-java#1186

Full Changelog: actions/setup-java@v5.6.0...v5.7.0

Commits

b6effb0 Deprecate legacy Adopt distributions in v5 (#1186)
e498d2a Backport #1151: Fix missing wrapper cache distributions (#1153)
6a3384d Fix npm audit failures on releases/v5 (#1154)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.85.3` | `2.85.13` | | [Swatinem/rust-cache](https://github.com/swatinem/rust-cache) | `2.9.1` | `2.9.2` | | [haskell-actions/setup](https://github.com/haskell-actions/setup) | `2.11.0` | `2.12.0` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.37.3` | `4.37.7` | | [docker/login-action](https://github.com/docker/login-action) | `4.5.2` | `4.6.0` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `4.1.1` | `4.2.2` | | [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) | `3.96.0` | `3.97.0` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.6.0` | `5.7.0` | Updates `taiki-e/install-action` from 2.85.3 to 2.85.13 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@v2.85.3...v2.85.13) Updates `Swatinem/rust-cache` from 2.9.1 to 2.9.2 - [Release notes](https://github.com/swatinem/rust-cache/releases) - [Changelog](https://github.com/Swatinem/rust-cache/blob/master/CHANGELOG.md) - [Commits](Swatinem/rust-cache@v2.9.1...v2.9.2) Updates `haskell-actions/setup` from 2.11.0 to 2.12.0 - [Release notes](https://github.com/haskell-actions/setup/releases) - [Commits](haskell-actions/setup@v2.11.0...v2.12.0) Updates `github/codeql-action` from 4.37.3 to 4.37.7 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4.37.3...v4.37.7) Updates `docker/login-action` from 4.5.2 to 4.6.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@v4.5.2...v4.6.0) Updates `actions/attest-build-provenance` from 4.1.1 to 4.2.2 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@v4.1.1...v4.2.2) Updates `trufflesecurity/trufflehog` from 3.96.0 to 3.97.0 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@v3.96.0...v3.97.0) Updates `actions/setup-java` from 5.6.0 to 5.7.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@v5.6.0...v5.7.0) --- updated-dependencies: - dependency-name: taiki-e/install-action dependency-version: 2.85.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: Swatinem/rust-cache dependency-version: 2.9.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: haskell-actions/setup dependency-version: 2.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action dependency-version: 4.37.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: docker/login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/attest-build-provenance dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: trufflesecurity/trufflehog dependency-version: 3.97.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/setup-java dependency-version: 5.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 17, 2026

Navigation Menu

Uh oh!

chore(deps): bump the actions group across 1 directory with 8 updates - #704

chore(deps): bump the actions group across 1 directory with 8 updates#704
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-136510ce3f

dependabot Bot commented on behalf of github Aug 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 17, 2026

2.85.13

2.85.12

2.85.11

2.85.10

[2.85.13] - 2026-08-13

[2.85.12] - 2026-08-12

[2.85.11] - 2026-08-09

v2.9.2

What's Changed

New Contributors

2.9.2

v4.37.7

v4.37.6

v4.37.5

v4.37.4

4.37.7 - 13 Aug 2026

4.37.6 - 04 Aug 2026

4.37.5 - 03 Aug 2026

4.37.4 - 29 Jul 2026

v4.6.0

v4.2.2

What's Changed

v3.97.0

What's Changed

New Contributors

v5.7.0

What's Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant