Skip to content

ci(deps): bump the github-actions group across 1 directory with 11 updates#13

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/dot-github/workflows/github-actions-037af04008
Open

ci(deps): bump the github-actions group across 1 directory with 11 updates#13
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/dot-github/workflows/github-actions-037af04008

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 13, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 11 updates in the /.github/workflows directory:

Package From To
step-security/harden-runner 2.14.0 2.17.0
actions/checkout 6.0.1 6.0.2
step-security/paths-filter 3.0.5 4.0.1
hashicorp/setup-terraform 3.1.2 4.0.0
terraform-linters/setup-tflint 6.2.1 6.2.2
actions/setup-python 6.1.0 6.2.0
imranismail/setup-kustomize 2.1.0 3.0.0
aquasecurity/trivy-action 0.33.1 0.35.0
github/codeql-action 4.31.9 4.35.1
bridgecrewio/checkov-action 12.3077.0 12.3094.0
Checkmarx/kics-github-action 00def9108246ec656aea725db2167522d26a99d2 4063ea7186bec9fed1bf055e095a4658693f9998

Updates step-security/harden-runner from 2.14.0 to 2.17.0

Release notes

Sourced from step-security/harden-runner's releases.

v2.17.0

What's Changed

Policy Store Support

Added use-policy-store and api-key inputs to fetch security policies directly from the StepSecurity Policy Store. Policies can be defined and attached at the workflow, repo, org, or cluster (ARC) level, with the most granular policy taking precedence. This is the preferred method over the existing policy input which requires id-token: write permission. If no policy is found in the store, the action defaults to audit mode.

Full Changelog: step-security/harden-runner@v2.16.1...v2.17.0

v2.16.1

What's Changed

Enterprise tier: Added support for direct IP addresses in the allow list Community tier: Migrated Harden Runner telemetry to a new endpoint

Full Changelog: step-security/harden-runner@v2.16.0...v2.16.1

v2.16.0

What's Changed

  • Updated action.yml to use node24
  • Security fix: Fixed a medium severity vulnerability where the egress block policy could be bypassed via DNS over HTTPS (DoH) by proxying DNS queries through a permitted resolver, allowing data exfiltration even with a restrictive allowed-endpoints list. This issue only affects the Community Tier; the Enterprise Tier is not affected. See GHSA-46g3-37rh-v698 for details.
  • Security fix: Fixed a medium severity vulnerability where the egress block policy could be bypassed via DNS queries over TCP to external resolvers, allowing outbound network communication that evades configured network restrictions. This issue only affects the Community Tier; the Enterprise Tier is not affected. See GHSA-g699-3x6g-wm3g for details.

Full Changelog: step-security/harden-runner@v2.15.1...v2.16.0

v2.15.1

What's Changed

Full Changelog: step-security/harden-runner@v2.15.0...v2.15.1

v2.15.0

What's Changed

Windows and macOS runner support

We are excited to announce that Harden Runner now supports Windows and macOS runners, extending runtime security beyond Linux for the first time.

Insights for Windows and macOS runners will be displayed in the same consistent format you are already familiar with from Linux runners, giving you a unified view of runtime activity across all platforms.

Full Changelog: step-security/harden-runner@v2.14.2...v2.15.0

v2.14.2

What's Changed

Security fix: Fixed a medium severity vulnerability where outbound network connections using sendto, sendmsg, and sendmmsg socket system calls could bypass audit logging when using egress-policy: audit. This issue only affects the Community Tier in audit mode; block mode and Enterprise Tier were not affected. See GHSA-cpmj-h4f6-r6pq for details.

Full Changelog: step-security/harden-runner@v2.14.1...v2.14.2

v2.14.1

What's Changed

... (truncated)

Commits

Updates actions/checkout from 6.0.1 to 6.0.2

Release notes

Sourced from actions/checkout's releases.

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

... (truncated)

Commits
  • de0fac2 Fix tag handling: preserve annotations and explicit fetch-tags (#2356)
  • 064fe7f Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...
  • See full diff in compare view

Updates step-security/paths-filter from 3.0.5 to 4.0.1

Release notes

Sourced from step-security/paths-filter's releases.

v4.0.1

What's Changed

Full Changelog: step-security/paths-filter@v3...v4.0.1

Commits
  • 5c5241b Merge pull request #243 from step-security/feat/update-subscription-check
  • 4a740b4 claude comments addressed
  • c3c4a64 feat: added banner and update subscription check to make maintained actions f...
  • e7a5f27 Merge pull request #241 from step-security/auto-cherry-pick
  • 81a12d9 chore: Cherry-picked changes from upstream for conflicting changes
  • 8f54c5a feat: add merge_group event support
  • 6a7c5d6 Merge pull request #240 from step-security/auto-cherry-pick
  • c79c47b chore: Cherry-picked changes from upstream in package.json
  • 000dc59 feat: update action runtime to node24
  • 60b52a2 Merge pull request #236 from step-security/auto-cherry-pick
  • Additional commits viewable in compare view

Updates hashicorp/setup-terraform from 3.1.2 to 4.0.0

Release notes

Sourced from hashicorp/setup-terraform's releases.

v4.0.0

BREAKING CHANGES:

  • Upgrade to Node.js 24 - setup-terraform now requires Node.js 24 (#503)
Changelog

Sourced from hashicorp/setup-terraform's changelog.

4.0.0 (2026-02-24)

BREAKING CHANGES:

  • Upgrade to Node.js 24 - setup-terraform now requires Node.js 24 (#503)

3.1.2 (2024-08-19)

NOTES:

  • This release introduces no functional changes. It does however include dependency updates which address upstream CVEs. (#430)

3.1.1 (2024-05-07)

BUG FIXES:

  • wrapper: Fix wrapper to output to stdout and stderr immediately when data is received (#395)

3.1.0 (2024-04-23)

ENHANCEMENTS:

  • Automatically fallback to darwin/amd64 for Terraform versions before 1.0.2 as releases for darwin/arm64 are not available (#409)

3.0.0 (2023-10-30)

NOTES:

  • Updated default runtime to node20 (#346)
  • The wrapper around the installed Terraform binary has been fixed to return the exact STDOUT and STDERR from Terraform when executing commands. Previous versions of setup-terraform may have required workarounds to process the STDOUT in bash, such as filtering out the first line or selectively parsing STDOUT with jq. These workarounds may need to be adjusted with v3.0.0, which will now return just the STDOUT/STDERR from Terraform with no errant characters/statements. (#367)

BUG FIXES:

  • Fixed malformed stdout when wrapper is enabled (#367)

[2.0.3] (2022-11-01)

NOTES

  • Reduced occurrences of GitHub Actions warnings for setting output #247

[2.0.2] (2022-10-12)

BUG FIXES

INTERNAL

... (truncated)

Commits
  • 5e8dbf3 Update package version
  • 6eb9b2a Update changelog
  • af062bc feat: upgrade to node 24 (#503)
  • ce70bcf Bump @​actions/github from 7.0.0 to 8.0.0 (#528)
  • d92091b Bump actions/checkout from 6.0.1 to 6.0.2 in the github-actions group (#527)
  • dcc3150 Bump actions/setup-node from 6.1.0 to 6.2.0 in the github-actions group (#525)
  • 93d5a27 Bump @​actions/github from 6.0.1 to 7.0.0 (#523)
  • 92e4d08 Bump dessant/lock-threads in the github-actions group (#519)
  • 071811a Bump the github-actions group with 2 updates (#517)
  • 712b439 Bump actions/checkout from 5.0.0 to 6.0.0 in the github-actions group (#515)
  • Additional commits viewable in compare view

Updates terraform-linters/setup-tflint from 6.2.1 to 6.2.2

Release notes

Sourced from terraform-linters/setup-tflint's releases.

v6.2.2

What's Changed

Dependencies

... (truncated)

Commits
  • b480b8f build(deps): Bump the actions group across 1 directory with 3 updates (#411)
  • d4e7bc7 build(deps-dev): Bump eslint-plugin-jsdoc from 61.5.0 to 62.8.0 (#409)
  • 29adf10 build(deps-dev): Bump globals from 16.4.0 to 17.4.0 (#408)
  • 5199340 build(deps): bump @​actions/glob from 0.5.0 to 0.6.1 (#410)
  • 6978713 build(deps-dev): Bump @​babel/eslint-parser from 7.28.5 to 7.28.6 (#406)
  • 4f44956 build(deps-dev): Bump jest from 30.2.0 to 30.3.0 (#407)
  • 84b5812 build(deps-dev): Bump eslint-plugin-jest from 29.2.1 to 29.15.0 (#405)
  • fb123f3 build(deps-dev): Bump @​eslint/eslintrc from 3.3.3 to 3.3.5 (#404)
  • da37435 build(deps): Bump actions/setup-node from 6.2.0 to 6.3.0 (#402)
  • 382cd91 ci: group @actions/* Dependabot updates (#401)
  • Additional commits viewable in compare view

Updates actions/setup-python from 6.1.0 to 6.2.0

Release notes

Sourced from actions/setup-python's releases.

v6.2.0

What's Changed

Dependency Upgrades

Full Changelog: actions/setup-python@v6...v6.2.0

Commits

Updates imranismail/setup-kustomize from 2.1.0 to 3.0.0

Release notes

Sourced from imranismail/setup-kustomize's releases.

v3.0.0

What's Changed

New Contributors

Full Changelog: imranismail/setup-kustomize@v2...v3.0.0

Commits

Updates aquasecurity/trivy-action from 0.33.1 to 0.35.0

Release notes

Sourced from aquasecurity/trivy-action's releases.

Release: 0.35.0

What's Changed

Full Changelog: aquasecurity/trivy-action@0.34.2...0.35.0

Release: v0.35.0

This release is a duplicate of 0.35.0 which was not compromised.

As part of our response to the recent supply chain attack, we have migrated all tags to use the v prefix (e.g., v0.35.0 instead of 0.35.0). Going forward, all new releases will use the v prefix convention.

We have intentionally kept the 0.35.0 tag intact to avoid breaking existing workflows that depend on it.

If you are currently using 0.35.0, your workflows are safe — no action is required.

Release: v0.34.0

Full Changelog: aquasecurity/trivy-action@v0.33.1...v0.34.0

Commits
  • 57a97c7 chore(deps): Update trivy to v0.69.3 (#519)
  • 97e0b38 chore: bump Trivy version to v0.69.2 in test workflow and README (#515)
  • 4c61e63 chore: bump default Trivy version to v0.69.2 (#513)
  • 1bd0625 Merge pull request #508 from nikpivkin/feat/pass-yaml-ignore-file
  • bce3086 remove unused init-cache target
  • 5a9fbb1 supress progress bar when download db
  • 1615450 update trivyignores input description
  • df85774 add comment about fd3
  • 56c8dae remove unused variable
  • e368e32 ci(test): add zizmor security linter for GitHub Actions (#502)
  • Additional commits viewable in compare view

Updates github/codeql-action from 4.31.9 to 4.35.1

Release notes

Sourced from github/codeql-action's releases.

v4.35.1

v4.35.0

v4.34.1

  • Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #3762

v4.34.0

  • Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569
  • We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584
  • Update default CodeQL bundle version to 2.25.0. #3585

v4.33.0

  • Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. #3562

    To opt out of this change:

    • Repositories owned by an organization: Create a custom repository property with the name github-codeql-file-coverage-on-prs and the type "True/false", then set this property to true in the repository's settings. For more information, see Managing custom properties for repositories in your organization. Alternatively, if you are using an advanced setup workflow, you can set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
    • User-owned repositories using default setup: Switch to an advanced setup workflow and set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
    • User-owned repositories using advanced setup: Set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

  • Fixed a bug which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. #3557

  • The CodeQL Action now loads custom repository properties on GitHub Enterprise Server, enabling the customization of features such as github-codeql-disable-overlay that was previously only available on GitHub.com. #3559

  • Once private package registries can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. #3563

  • Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". #3564

  • A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. #3570

v4.32.6

  • Update default CodeQL bundle version to 2.24.3. #3548

v4.32.5

  • Repositories owned by an organization can now set up the github-codeql-disable-overlay custom repository property to disable improved incremental analysis for CodeQL. First, create a custom repository property with the name github-codeql-disable-overlay and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to true to disable improved incremental analysis. For more information, see Managing custom properties for repositories in your organization. This feature is not yet available on GitHub Enterprise Server. #3507
  • Added an experimental change so that when improved incremental analysis fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. #3487
  • The minimum memory check for improved incremental analysis is now skipped for CodeQL 2.24.3 and later, which has reduced peak RAM usage. #3515
  • Reduced log levels for best-effort private package registry connection check failures to reduce noise from workflow annotations. #3516
  • Added an experimental change which lowers the minimum disk space requirement for improved incremental analysis, enabling it to run on standard GitHub Actions runners. We expect to roll this change out to everyone in March. #3498
  • Added an experimental change which allows the start-proxy action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. #3512
  • The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. #3503, #3504

v4.32.4

  • Update default CodeQL bundle version to 2.24.2. #3493
  • Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when private package registries are configured. This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. #3473
  • When the CodeQL Action is run with debugging enabled in Default Setup and private package registries are configured, the "Setup proxy for registries" step will output additional diagnostic information that can be used for troubleshooting. #3486
  • Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. #3485
  • Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a nightly CodeQL CLI release instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff.

@dependabot
ci(deps): bump the github-actions group across 1 directory with 11 up…
6a5b790 
…dates

Bumps the github-actions group with 11 updates in the /.github/workflows directory:

| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.14.0` | `2.17.0` |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.1` | `6.0.2` |
| [step-security/paths-filter](https://github.com/step-security/paths-filter) | `3.0.5` | `4.0.1` |
| [hashicorp/setup-terraform](https://github.com/hashicorp/setup-terraform) | `3.1.2` | `4.0.0` |
| [terraform-linters/setup-tflint](https://github.com/terraform-linters/setup-tflint) | `6.2.1` | `6.2.2` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.1.0` | `6.2.0` |
| [imranismail/setup-kustomize](https://github.com/imranismail/setup-kustomize) | `2.1.0` | `3.0.0` |
| [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) | `0.33.1` | `0.35.0` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.31.9` | `4.35.1` |
| [bridgecrewio/checkov-action](https://github.com/bridgecrewio/checkov-action) | `12.3077.0` | `12.3094.0` |
| [Checkmarx/kics-github-action](https://github.com/checkmarx/kics-github-action) | `00def9108246ec656aea725db2167522d26a99d2` | `4063ea7186bec9fed1bf055e095a4658693f9998` |



Updates `step-security/harden-runner` from 2.14.0 to 2.17.0
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@20cf305...f808768)

Updates `actions/checkout` from 6.0.1 to 6.0.2
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@8e8c483...de0fac2)

Updates `step-security/paths-filter` from 3.0.5 to 4.0.1
- [Release notes](https://github.com/step-security/paths-filter/releases)
- [Commits](step-security/paths-filter@6eee183...5c5241b)

Updates `hashicorp/setup-terraform` from 3.1.2 to 4.0.0
- [Release notes](https://github.com/hashicorp/setup-terraform/releases)
- [Changelog](https://github.com/hashicorp/setup-terraform/blob/main/CHANGELOG.md)
- [Commits](hashicorp/setup-terraform@b9cd54a...5e8dbf3)

Updates `terraform-linters/setup-tflint` from 6.2.1 to 6.2.2
- [Release notes](https://github.com/terraform-linters/setup-tflint/releases)
- [Commits](terraform-linters/setup-tflint@4cb9fee...b480b8f)

Updates `actions/setup-python` from 6.1.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@83679a8...a309ff8)

Updates `imranismail/setup-kustomize` from 2.1.0 to 3.0.0
- [Release notes](https://github.com/imranismail/setup-kustomize/releases)
- [Commits](imranismail/setup-kustomize@2ba527d...53f941b)

Updates `aquasecurity/trivy-action` from 0.33.1 to 0.35.0
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](aquasecurity/trivy-action@b6643a2...57a97c7)

Updates `github/codeql-action` from 4.31.9 to 4.35.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@5d4e8d1...c10b806)

Updates `bridgecrewio/checkov-action` from 12.3077.0 to 12.3094.0
- [Release notes](https://github.com/bridgecrewio/checkov-action/releases)
- [Commits](bridgecrewio/checkov-action@8f61ce5...9ff61ad)

Updates `Checkmarx/kics-github-action` from 00def9108246ec656aea725db2167522d26a99d2 to 4063ea7186bec9fed1bf055e095a4658693f9998
- [Release notes](https://github.com/checkmarx/kics-github-action/releases)
- [Commits](Checkmarx/kics-github-action@00def91...4063ea7)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: step-security/paths-filter
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: hashicorp/setup-terraform
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: terraform-linters/setup-tflint
  dependency-version: 6.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: imranismail/setup-kustomize
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: aquasecurity/trivy-action
  dependency-version: 0.35.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action
  dependency-version: 4.35.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: bridgecrewio/checkov-action
  dependency-version: 12.3094.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: Checkmarx/kics-github-action
  dependency-version: 4063ea7186bec9fed1bf055e095a4658693f9998
  dependency-type: direct:production
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added area/ci CI/CD area/deps Dependencies labels Apr 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/ci CI/CD area/deps Dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants